diff --git a/Microsoft.Toolkit.HighPerformance/Attributes/IgnoresAccessChecksToAttribute.cs b/Microsoft.Toolkit.HighPerformance/Attributes/IgnoresAccessChecksToAttribute.cs
new file mode 100644
index 00000000000..a813d3b2a24
--- /dev/null
+++ b/Microsoft.Toolkit.HighPerformance/Attributes/IgnoresAccessChecksToAttribute.cs
@@ -0,0 +1,31 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+#if NETCORE_RUNTIME
+
+namespace System.Runtime.CompilerServices
+{
+    /// <summary>
+    /// A special attribute recognized by CoreCLR that allows to ignore visibility checks for internal APIs.
+    /// </summary>
+    [AttributeUsage(AttributeTargets.Assembly, AllowMultiple = true)]
+    internal sealed class IgnoresAccessChecksToAttribute : Attribute
+    {
+        /// <summary>
+        /// Initializes a new instance of the <see cref="IgnoresAccessChecksToAttribute"/> class.
+        /// </summary>
+        /// <param name="assemblyName">The assembly name to use.</param>
+        public IgnoresAccessChecksToAttribute(string assemblyName)
+        {
+            AssemblyName = assemblyName;
+        }
+
+        /// <summary>
+        /// Gets the assembly name to use.
+        /// </summary>
+        public string AssemblyName { get; }
+    }
+}
+
+#endif
diff --git a/Microsoft.Toolkit.HighPerformance/Microsoft.Toolkit.HighPerformance.csproj b/Microsoft.Toolkit.HighPerformance/Microsoft.Toolkit.HighPerformance.csproj
index 06c9e584da5..047743a0086 100644
--- a/Microsoft.Toolkit.HighPerformance/Microsoft.Toolkit.HighPerformance.csproj
+++ b/Microsoft.Toolkit.HighPerformance/Microsoft.Toolkit.HighPerformance.csproj
@@ -76,6 +76,16 @@
       </PropertyGroup>
     </When>
     <When Condition=" '$(TargetFramework)' == 'netcoreapp3.1' ">
+      <ItemGroup>
+
+        <!-- This is the fake System.Private.CoreLib assembly we need to be able to reference and use the
+             internal ByReference<T> type available on .NET Core 2.1+. The Private="false" property prevents
+             the resulting assembly from being copied to the output directory: this is what causes the runtime
+             to just use the real System.Private.CoreLib during execution (this project acts more like a proxy).
+             The PrivateAssets="all" property is used to hide this reference from NuGet, so that users adding a
+             reference to Microsoft.Toolkit.HighPerformance won't see the System.Private.CoreLib dependency. -->
+        <ProjectReference Include="..\System.Private.CoreLib\System.Private.CoreLib.csproj" Private="false" PrivateAssets="all" />
+      </ItemGroup>
       <PropertyGroup>
 
         <!-- NETCORE_RUNTIME: to avoid issues with APIs that assume a specific memory layout, we define a
@@ -91,6 +101,9 @@
       <ItemGroup>
         <PackageReference Include="System.Runtime.CompilerServices.Unsafe" Version="4.7.1" />
       </ItemGroup>
+      <ItemGroup>
+        <ProjectReference Include="..\System.Private.CoreLib\System.Private.CoreLib.csproj" Private="false" PrivateAssets="all" />
+      </ItemGroup>
       <PropertyGroup>
         <DefineConstants>SPAN_RUNTIME_SUPPORT;NETCORE_RUNTIME</DefineConstants>
       </PropertyGroup>
diff --git a/Microsoft.Toolkit.HighPerformance/NullableReadOnlyRef{T}.cs b/Microsoft.Toolkit.HighPerformance/NullableReadOnlyRef{T}.cs
index 1742bfcad21..dc6ff6c6b35 100644
--- a/Microsoft.Toolkit.HighPerformance/NullableReadOnlyRef{T}.cs
+++ b/Microsoft.Toolkit.HighPerformance/NullableReadOnlyRef{T}.cs
@@ -6,7 +6,9 @@
 
 using System;
 using System.Runtime.CompilerServices;
+#if !NETCORE_RUNTIME
 using System.Runtime.InteropServices;
+#endif
 
 namespace Microsoft.Toolkit.HighPerformance
 {
@@ -16,6 +18,32 @@ namespace Microsoft.Toolkit.HighPerformance
     /// <typeparam name="T">The type of value to reference.</typeparam>
     public readonly ref struct NullableReadOnlyRef<T>
     {
+#if NETCORE_RUNTIME
+        /// <summary>
+        /// The <see cref="ByReference{T}"/> instance holding the current reference.
+        /// </summary>
+        private readonly ByReference<T> byReference;
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="NullableReadOnlyRef{T}"/> struct.
+        /// </summary>
+        /// <param name="value">The readonly reference to the target <typeparamref name="T"/> value.</param>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public NullableReadOnlyRef(in T value)
+        {
+            this.byReference = new ByReference<T>(ref Unsafe.AsRef(value));
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="NullableReadOnlyRef{T}"/> struct.
+        /// </summary>
+        /// <param name="byReference">The <see cref="ByReference{T}"/> instance holding the target reference.</param>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        private NullableReadOnlyRef(ByReference<T> byReference)
+        {
+            this.byReference = byReference;
+        }
+#else
         /// <summary>
         /// The 1-length <see cref="ReadOnlySpan{T}"/> instance used to track the target <typeparamref name="T"/> value.
         /// </summary>
@@ -42,6 +70,7 @@ private NullableReadOnlyRef(ReadOnlySpan<T> span)
         {
             this.span = span;
         }
+#endif
 
         /// <summary>
         /// Gets a <see cref="NullableReadOnlyRef{T}"/> instance representing a <see langword="null"/> reference.
@@ -60,10 +89,17 @@ public bool HasValue
             [MethodImpl(MethodImplOptions.AggressiveInlining)]
             get
             {
+#if NETCORE_RUNTIME
+                unsafe
+                {
+                    return !Unsafe.AreSame(ref this.byReference.Value, ref Unsafe.AsRef<T>(null));
+                }
+#else
                 // See comment in NullableRef<T> about this
                 byte length = unchecked((byte)this.span.Length);
 
                 return Unsafe.As<byte, bool>(ref length);
+#endif
             }
         }
 
@@ -81,7 +117,11 @@ public ref readonly T Value
                     ThrowInvalidOperationException();
                 }
 
+#if NETCORE_RUNTIME
+                return ref this.byReference.Value;
+#else
                 return ref MemoryMarshal.GetReference(this.span);
+#endif
             }
         }
 
@@ -92,7 +132,11 @@ public ref readonly T Value
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
         public static implicit operator NullableReadOnlyRef<T>(Ref<T> reference)
         {
+#if NETCORE_RUNTIME
+            return new NullableReadOnlyRef<T>(reference.ByReference);
+#else
             return new NullableReadOnlyRef<T>(reference.Span);
+#endif
         }
 
         /// <summary>
@@ -102,7 +146,11 @@ public static implicit operator NullableReadOnlyRef<T>(Ref<T> reference)
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
         public static implicit operator NullableReadOnlyRef<T>(ReadOnlyRef<T> reference)
         {
+#if NETCORE_RUNTIME
+            return new NullableReadOnlyRef<T>(reference.ByReference);
+#else
             return new NullableReadOnlyRef<T>(reference.Span);
+#endif
         }
 
         /// <summary>
@@ -112,7 +160,11 @@ public static implicit operator NullableReadOnlyRef<T>(ReadOnlyRef<T> reference)
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
         public static implicit operator NullableReadOnlyRef<T>(NullableRef<T> reference)
         {
+#if NETCORE_RUNTIME
+            return new NullableReadOnlyRef<T>(reference.ByReference);
+#else
             return new NullableReadOnlyRef<T>(reference.Span);
+#endif
         }
 
         /// <summary>
diff --git a/Microsoft.Toolkit.HighPerformance/NullableRef{T}.cs b/Microsoft.Toolkit.HighPerformance/NullableRef{T}.cs
index d8d855799eb..2ff3e669664 100644
--- a/Microsoft.Toolkit.HighPerformance/NullableRef{T}.cs
+++ b/Microsoft.Toolkit.HighPerformance/NullableRef{T}.cs
@@ -6,7 +6,9 @@
 
 using System;
 using System.Runtime.CompilerServices;
+#if !NETCORE_RUNTIME
 using System.Runtime.InteropServices;
+#endif
 
 namespace Microsoft.Toolkit.HighPerformance
 {
@@ -16,6 +18,32 @@ namespace Microsoft.Toolkit.HighPerformance
     /// <typeparam name="T">The type of value to reference.</typeparam>
     public readonly ref struct NullableRef<T>
     {
+#if NETCORE_RUNTIME
+        /// <summary>
+        /// The <see cref="ByReference{T}"/> instance holding the current reference.
+        /// </summary>
+        internal readonly ByReference<T> ByReference;
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="NullableRef{T}"/> struct.
+        /// </summary>
+        /// <param name="value">The readonly reference to the target <typeparamref name="T"/> value.</param>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public NullableRef(ref T value)
+        {
+            ByReference = new ByReference<T>(ref value);
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="NullableRef{T}"/> struct.
+        /// </summary>
+        /// <param name="byReference">The <see cref="ByReference{T}"/> instance holding the target reference.</param>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        private NullableRef(ByReference<T> byReference)
+        {
+            ByReference = byReference;
+        }
+#else
         /// <summary>
         /// The 1-length <see cref="Span{T}"/> instance used to track the target <typeparamref name="T"/> value.
         /// </summary>
@@ -40,6 +68,7 @@ private NullableRef(Span<T> span)
         {
             Span = span;
         }
+#endif
 
         /// <summary>
         /// Gets a <see cref="NullableRef{T}"/> instance representing a <see langword="null"/> reference.
@@ -58,6 +87,12 @@ public bool HasValue
             [MethodImpl(MethodImplOptions.AggressiveInlining)]
             get
             {
+#if NETCORE_RUNTIME
+                unsafe
+                {
+                    return !Unsafe.AreSame(ref ByReference.Value, ref Unsafe.AsRef<T>(null));
+                }
+#else
                 // We know that the span will always have a length of either
                 // 1 or 0, so instead of using a cmp instruction and setting the
                 // zero flag to produce our boolean value, we can just cast
@@ -68,6 +103,7 @@ public bool HasValue
                 byte length = unchecked((byte)Span.Length);
 
                 return Unsafe.As<byte, bool>(ref length);
+#endif
             }
         }
 
@@ -85,7 +121,11 @@ public ref T Value
                     ThrowInvalidOperationException();
                 }
 
+#if NETCORE_RUNTIME
+                return ref ByReference.Value;
+#else
                 return ref MemoryMarshal.GetReference(Span);
+#endif
             }
         }
 
@@ -96,7 +136,11 @@ public ref T Value
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
         public static implicit operator NullableRef<T>(Ref<T> reference)
         {
+#if NETCORE_RUNTIME
+            return new NullableRef<T>(reference.ByReference);
+#else
             return new NullableRef<T>(reference.Span);
+#endif
         }
 
         /// <summary>
diff --git a/Microsoft.Toolkit.HighPerformance/Properties/AssemblyInfo.cs b/Microsoft.Toolkit.HighPerformance/Properties/AssemblyInfo.cs
new file mode 100644
index 00000000000..7ed1b82ac31
--- /dev/null
+++ b/Microsoft.Toolkit.HighPerformance/Properties/AssemblyInfo.cs
@@ -0,0 +1,20 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+#if NETCORE_RUNTIME
+
+using System.Runtime.CompilerServices;
+
+// This is needed so that the runtime will actually let us access the internal
+// ByReference<T> type exposed through the fake System.Private.CoreLib assembly
+// that is referenced by this project. The reason for this is that while the proxy
+// type we declared belongs to a project we have internals access to, the real
+// ByReference<T> from the actual CoreLib assembly does not, so the runtime would
+// normally fail to load the type if this attribute wasn't present.
+// Note that while this attribute is internally recognized by the runtime, we still
+// need the fake CoreLib assembly to be able to use the type when building from source,
+// as Roslyn itself does not actually recognize and/or respect it.
+[assembly: IgnoresAccessChecksTo("System.Private.CoreLib")]
+
+#endif
diff --git a/Microsoft.Toolkit.HighPerformance/ReadOnlyRef{T}.cs b/Microsoft.Toolkit.HighPerformance/ReadOnlyRef{T}.cs
index 1945e1dffde..d5d965fe158 100644
--- a/Microsoft.Toolkit.HighPerformance/ReadOnlyRef{T}.cs
+++ b/Microsoft.Toolkit.HighPerformance/ReadOnlyRef{T}.cs
@@ -3,8 +3,10 @@
 // See the LICENSE file in the project root for more information.
 
 using System;
+using System.Diagnostics.Contracts;
 using System.Runtime.CompilerServices;
-#if SPAN_RUNTIME_SUPPORT
+#if NETCORE_RUNTIME
+#elif SPAN_RUNTIME_SUPPORT
 using System.Runtime.InteropServices;
 #else
 using Microsoft.Toolkit.HighPerformance.Extensions;
@@ -18,7 +20,47 @@ namespace Microsoft.Toolkit.HighPerformance
     /// <typeparam name="T">The type of value to reference.</typeparam>
     public readonly ref struct ReadOnlyRef<T>
     {
-#if SPAN_RUNTIME_SUPPORT
+#if NETCORE_RUNTIME
+        /// <summary>
+        /// The <see cref="ByReference{T}"/> instance holding the current reference.
+        /// </summary>
+        internal readonly ByReference<T> ByReference;
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="ReadOnlyRef{T}"/> struct.
+        /// </summary>
+        /// <param name="value">The reference to the target <typeparamref name="T"/> value.</param>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public ReadOnlyRef(in T value)
+        {
+            ByReference = new ByReference<T>(ref Unsafe.AsRef(value));
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="ReadOnlyRef{T}"/> struct.
+        /// </summary>
+        /// <param name="pointer">The pointer to the target <typeparamref name="T"/> value.</param>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public unsafe ReadOnlyRef(void* pointer)
+        {
+            if (RuntimeHelpers.IsReferenceOrContainsReferences<T>())
+            {
+                ThrowArgumentExceptionForInvalidType();
+            }
+
+            ByReference = new ByReference<T>(ref Unsafe.AsRef<T>(pointer));
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="ReadOnlyRef{T}"/> struct.
+        /// </summary>
+        /// <param name="byReference">The input <see cref="ByReference{T}"/> to the target <typeparamref name="T"/> value.</param>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        private ReadOnlyRef(ByReference<T> byReference)
+        {
+            ByReference = byReference;
+        }
+#elif SPAN_RUNTIME_SUPPORT
         /// <summary>
         /// The 1-length <see cref="ReadOnlySpan{T}"/> instance used to track the target <typeparamref name="T"/> value.
         /// </summary>
@@ -39,30 +81,26 @@ public ReadOnlyRef(in T value)
         /// <summary>
         /// Initializes a new instance of the <see cref="ReadOnlyRef{T}"/> struct.
         /// </summary>
-        /// <param name="pointer">The pointer to the target value.</param>
+        /// <param name="pointer">The pointer to the target <typeparamref name="T"/> value.</param>
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
         public unsafe ReadOnlyRef(void* pointer)
-            : this(Unsafe.AsRef<T>(pointer))
         {
-        }
+            if (RuntimeHelpers.IsReferenceOrContainsReferences<T>())
+            {
+                ThrowArgumentExceptionForInvalidType();
+            }
 
-        /// <summary>
-        /// Gets the readonly <typeparamref name="T"/> reference represented by the current <see cref="Ref{T}"/> instance.
-        /// </summary>
-        public ref readonly T Value
-        {
-            [MethodImpl(MethodImplOptions.AggressiveInlining)]
-            get => ref MemoryMarshal.GetReference(Span);
+            Span = new ReadOnlySpan<T>(pointer, 1);
         }
 
         /// <summary>
-        /// Implicitly converts a <see cref="Ref{T}"/> instance into a <see cref="ReadOnlyRef{T}"/> one.
+        /// Initializes a new instance of the <see cref="ReadOnlyRef{T}"/> struct.
         /// </summary>
-        /// <param name="reference">The input <see cref="Ref{T}"/> instance.</param>
+        /// <param name="span">The input <see cref="ReadOnlySpan{T}"/> targeting the current value.</param>
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
-        public static implicit operator ReadOnlyRef<T>(Ref<T> reference)
+        private ReadOnlyRef(ReadOnlySpan<T> span)
         {
-            return new ReadOnlyRef<T>(reference.Value);
+            Span = span;
         }
 #else
         /// <summary>
@@ -100,14 +138,119 @@ public ReadOnlyRef(object owner, in T value)
             this.owner = owner;
             this.offset = owner.DangerousGetObjectDataByteOffset(ref Unsafe.AsRef(value));
         }
+#endif
 
         /// <summary>
-        /// Gets the readonly <typeparamref name="T"/> reference represented by the current <see cref="Ref{T}"/> instance.
+        /// Gets the <typeparamref name="T"/> reference represented by the current <see cref="ReadOnlyRef{T}"/> instance.
         /// </summary>
         public ref readonly T Value
         {
             [MethodImpl(MethodImplOptions.AggressiveInlining)]
-            get => ref this.owner.DangerousGetObjectDataReferenceAt<T>(this.offset);
+            get
+            {
+#if NETCORE_RUNTIME
+                return ref this.ByReference.Value;
+#elif SPAN_RUNTIME_SUPPORT
+                return ref MemoryMarshal.GetReference(Span);
+#else
+                return ref this.owner.DangerousGetObjectDataReferenceAt<T>(this.offset);
+#endif
+            }
+        }
+
+        /// <summary>
+        /// Gets a reference to an element at a specified offset with respect to <see cref="Value"/>.
+        /// </summary>
+        /// <param name="offset">The offset of the element to retrieve, starting from the reference provided by <see cref="Value"/>.</param>
+        /// <remarks>
+        /// This indexer offers a layer of abstraction over <see cref="Unsafe.Add{T}(ref T,int)"/>, and similarly it does
+        /// not do any kind of input validation. It is responsability of the caller to ensure the supplied offset is valid.
+        /// </remarks>
+        public unsafe ref readonly T this[int offset]
+        {
+            [MethodImpl(MethodImplOptions.AggressiveInlining)]
+            get
+            {
+#if NETCORE_RUNTIME
+                return ref Unsafe.Add(ref ByReference.Value, (IntPtr)(void*)(uint)offset);
+#elif SPAN_RUNTIME_SUPPORT
+                return ref Unsafe.Add(ref MemoryMarshal.GetReference(Span), (IntPtr)(void*)(uint)offset);
+#else
+                ref T r0 = ref this.owner.DangerousGetObjectDataReferenceAt<T>(this.offset);
+                ref T r1 = ref Unsafe.Add(ref r0, (IntPtr)(void*)(uint)offset);
+
+                return ref r1;
+#endif
+            }
+        }
+
+        /// <summary>
+        /// Gets a reference to an element at a specified offset with respect to <see cref="Value"/>.
+        /// </summary>
+        /// <param name="offset">The offset of the element to retrieve, starting from the reference provided by <see cref="Value"/>.</param>
+        /// <remarks>
+        /// This indexer offers a layer of abstraction over <see cref="Unsafe.Add{T}(ref T,IntPtr)"/>, and similarly it does
+        /// not do any kind of input validation. It is responsability of the caller to ensure the supplied offset is valid.
+        /// </remarks>
+        public ref readonly T this[nint offset]
+        {
+            [MethodImpl(MethodImplOptions.AggressiveInlining)]
+            get
+            {
+#if NETCORE_RUNTIME
+                return ref Unsafe.Add(ref ByReference.Value, offset);
+#elif SPAN_RUNTIME_SUPPORT
+                return ref Unsafe.Add(ref MemoryMarshal.GetReference(Span), offset);
+#else
+                ref T r0 = ref this.owner.DangerousGetObjectDataReferenceAt<T>(this.offset);
+                ref T r1 = ref Unsafe.Add(ref r0, offset);
+
+                return ref r1;
+#endif
+            }
+        }
+
+        /// <summary>
+        /// Returns a mutable reference with the same target as <see cref="Value"/>.
+        /// </summary>
+        /// <returns>A mutable reference equivalent to the one returned by <see cref="Value"/>.</returns>
+        [Pure]
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public ref T DangerousGetReference()
+        {
+            return ref Unsafe.AsRef(Value);
+        }
+
+        /// <summary>
+        /// Returns a reference to an element at a specified offset with respect to <see cref="Value"/>.
+        /// </summary>
+        /// <param name="offset">The offset of the element to retrieve, starting from the reference provided by <see cref="Value"/>.</param>
+        /// <returns>A reference to the element at the specified offset from <see cref="Value"/>.</returns>
+        /// <remarks>
+        /// This method offers a layer of abstraction over <see cref="Unsafe.Add{T}(ref T,int)"/>, and similarly it does
+        /// not do any kind of input validation. It is responsability of the caller to ensure the supplied offset is valid.
+        /// </remarks>
+        [Pure]
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public ref T DangerousGetReferenceAt(int offset)
+        {
+            return ref Unsafe.AsRef(this[offset]);
+        }
+
+        /// <summary>
+        /// Returns a reference to an element at a specified offset with respect to <see cref="Value"/>.
+        /// </summary>
+        /// <param name="offset">The offset of the element to retrieve, starting from the reference provided by <see cref="Value"/>.</param>
+        /// <returns>A reference to the element at the specified offset from <see cref="Value"/>.</returns>
+        /// <remarks>
+        /// This method offers a layer of abstraction over <see cref="Unsafe.Add{T}(ref T,IntPtr)"/>, and similarly it does
+        /// not do any kind of input validation. It is responsability of the caller to ensure the supplied offset is valid.
+        /// </remarks>
+        [Pure]
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public ref T DangerousGetReferenceAt(IntPtr offset)
+        {
+            return ref Unsafe.AsRef(this[offset]);
         }
 
         /// <summary>
@@ -117,7 +260,40 @@ public ref readonly T Value
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
         public static implicit operator ReadOnlyRef<T>(Ref<T> reference)
         {
+#if NETCORE_RUNTIME
+            return new ReadOnlyRef<T>(reference.ByReference);
+#elif SPAN_RUNTIME_SUPPORT
+            return new ReadOnlyRef<T>(reference.Span);
+#else
             return new ReadOnlyRef<T>(reference.Owner, reference.Offset);
+#endif
+        }
+
+#if SPAN_RUNTIME_SUPPORT
+        /// <summary>
+        /// Explicitly converts a <see cref="NullableRef{T}"/> instance into a <see cref="ReadOnlyRef{T}"/> one.
+        /// </summary>
+        /// <param name="reference">The input <see cref="NullableRef{T}"/> instance.</param>
+        /// <exception cref="InvalidOperationException">
+        /// Thrown if <paramref name="reference"/> has the <see cref="NullableRef{T}.HasValue"/> property set to <see langword="false"/>.
+        /// </exception>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public static explicit operator ReadOnlyRef<T>(NullableRef<T> reference)
+        {
+            return new ReadOnlyRef<T>(reference.Value);
+        }
+
+        /// <summary>
+        /// Explicitly converts a <see cref="NullableReadOnlyRef{T}"/> instance into a <see cref="ReadOnlyRef{T}"/> one.
+        /// </summary>
+        /// <param name="reference">The input <see cref="NullableReadOnlyRef{T}"/> instance.</param>
+        /// <exception cref="InvalidOperationException">
+        /// Thrown if <paramref name="reference"/> has the <see cref="NullableReadOnlyRef{T}.HasValue"/> property set to <see langword="false"/>.
+        /// </exception>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public static explicit operator ReadOnlyRef<T>(NullableReadOnlyRef<T> reference)
+        {
+            return new ReadOnlyRef<T>(reference.Value);
         }
 #endif
 
@@ -130,5 +306,15 @@ public static implicit operator T(ReadOnlyRef<T> reference)
         {
             return reference.Value;
         }
+
+#if SPAN_RUNTIME_SUPPORT
+        /// <summary>
+        /// Throws an <see cref="ArgumentException"/> when trying to create a <see cref="ReadOnlyRef{T}"/> from a pointer to a managed type.
+        /// </summary>
+        private static void ThrowArgumentExceptionForInvalidType()
+        {
+            throw new ArgumentException("The ReadOnlyRef<T>(void*) constructor can only be used when T is an unmanaged type");
+        }
+#endif
     }
 }
diff --git a/Microsoft.Toolkit.HighPerformance/Ref{T}.cs b/Microsoft.Toolkit.HighPerformance/Ref{T}.cs
index e821a365969..35fb353f3da 100644
--- a/Microsoft.Toolkit.HighPerformance/Ref{T}.cs
+++ b/Microsoft.Toolkit.HighPerformance/Ref{T}.cs
@@ -4,7 +4,8 @@
 
 using System;
 using System.Runtime.CompilerServices;
-#if SPAN_RUNTIME_SUPPORT
+#if NETCORE_RUNTIME
+#elif SPAN_RUNTIME_SUPPORT
 using System.Runtime.InteropServices;
 #else
 using Microsoft.Toolkit.HighPerformance.Extensions;
@@ -18,11 +19,11 @@ namespace Microsoft.Toolkit.HighPerformance
     /// <typeparam name="T">The type of value to reference.</typeparam>
     public readonly ref struct Ref<T>
     {
-#if SPAN_RUNTIME_SUPPORT
+#if NETCORE_RUNTIME
         /// <summary>
-        /// The 1-length <see cref="Span{T}"/> instance used to track the target <typeparamref name="T"/> value.
+        /// The <see cref="ByReference{T}"/> instance holding the current reference.
         /// </summary>
-        internal readonly Span<T> Span;
+        internal readonly ByReference<T> ByReference;
 
         /// <summary>
         /// Initializes a new instance of the <see cref="Ref{T}"/> struct.
@@ -31,27 +32,54 @@ public readonly ref struct Ref<T>
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
         public Ref(ref T value)
         {
-            Span = MemoryMarshal.CreateSpan(ref value, 1);
+            ByReference = new ByReference<T>(ref value);
         }
 
         /// <summary>
         /// Initializes a new instance of the <see cref="Ref{T}"/> struct.
         /// </summary>
-        /// <param name="pointer">The pointer to the target value.</param>
+        /// <param name="pointer">The pointer to the target <typeparamref name="T"/> value.</param>
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
         public unsafe Ref(void* pointer)
-            : this(ref Unsafe.AsRef<T>(pointer))
         {
+            if (RuntimeHelpers.IsReferenceOrContainsReferences<T>())
+            {
+                ThrowArgumentExceptionForInvalidType();
+            }
+
+            ByReference = new ByReference<T>(ref Unsafe.AsRef<T>(pointer));
         }
+#elif SPAN_RUNTIME_SUPPORT
+        /// <summary>
+        /// The 1-length <see cref="Span{T}"/> instance used to track the target <typeparamref name="T"/> value.
+        /// </summary>
+        internal readonly Span<T> Span;
 
         /// <summary>
-        /// Gets the <typeparamref name="T"/> reference represented by the current <see cref="Ref{T}"/> instance.
+        /// Initializes a new instance of the <see cref="Ref{T}"/> struct.
         /// </summary>
-        public ref T Value
+        /// <param name="value">The reference to the target <typeparamref name="T"/> value.</param>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public Ref(ref T value)
         {
-            [MethodImpl(MethodImplOptions.AggressiveInlining)]
-            get => ref MemoryMarshal.GetReference(Span);
+            Span = MemoryMarshal.CreateSpan(ref value, 1);
         }
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="Ref{T}"/> struct.
+        /// </summary>
+        /// <param name="pointer">The pointer to the target <typeparamref name="T"/> value.</param>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public unsafe Ref(void* pointer)
+        {
+            if (RuntimeHelpers.IsReferenceOrContainsReferences<T>())
+            {
+                ThrowArgumentExceptionForInvalidType();
+            }
+
+            Span = new Span<T>(pointer, 1);
+        }
+
 #else
         /// <summary>
         /// The owner <see cref="object"/> the current instance belongs to
@@ -61,10 +89,6 @@ public ref T Value
         /// <summary>
         /// The target offset within <see cref="Owner"/> the current instance is pointing to
         /// </summary>
-        /// <remarks>
-        /// Using an <see cref="IntPtr"/> instead of <see cref="int"/> to avoid the int to
-        /// native int conversion in the generated asm (an extra movsxd on x64).
-        /// </remarks>
         internal readonly IntPtr Offset;
 
         /// <summary>
@@ -77,8 +101,9 @@ public ref T Value
         public Ref(object owner, ref T value)
         {
             Owner = owner;
-            Offset = owner.DangerousGetObjectDataByteOffset(ref value);
+            Offset = owner.DangerousGetObjectDataByteOffset(ref Unsafe.AsRef(value));
         }
+#endif
 
         /// <summary>
         /// Gets the <typeparamref name="T"/> reference represented by the current <see cref="Ref{T}"/> instance.
@@ -86,7 +111,82 @@ public Ref(object owner, ref T value)
         public ref T Value
         {
             [MethodImpl(MethodImplOptions.AggressiveInlining)]
-            get => ref Owner.DangerousGetObjectDataReferenceAt<T>(Offset);
+            get
+            {
+#if NETCORE_RUNTIME
+                return ref ByReference.Value;
+#elif SPAN_RUNTIME_SUPPORT
+                return ref MemoryMarshal.GetReference(Span);
+#else
+                return ref Owner.DangerousGetObjectDataReferenceAt<T>(Offset);
+#endif
+            }
+        }
+
+        /// <summary>
+        /// Gets a reference to an element at a specified offset with respect to <see cref="Value"/>.
+        /// </summary>
+        /// <param name="offset">The offset of the element to retrieve, starting from the reference provided by <see cref="Value"/>.</param>
+        /// <remarks>
+        /// This indexer offers a layer of abstraction over <see cref="Unsafe.Add{T}(ref T,int)"/>, and similarly it does
+        /// not do any kind of input validation. It is responsability of the caller to ensure the supplied offset is valid.
+        /// </remarks>
+        public unsafe ref T this[int offset]
+        {
+            [MethodImpl(MethodImplOptions.AggressiveInlining)]
+            get
+            {
+#if NETCORE_RUNTIME
+                return ref Unsafe.Add(ref ByReference.Value, (IntPtr)(void*)(uint)offset);
+#elif SPAN_RUNTIME_SUPPORT
+                return ref Unsafe.Add(ref MemoryMarshal.GetReference(Span), (IntPtr)(void*)(uint)offset);
+#else
+                ref T r0 = ref Owner.DangerousGetObjectDataReferenceAt<T>(Offset);
+                ref T r1 = ref Unsafe.Add(ref r0, (IntPtr)(void*)(uint)offset);
+
+                return ref r1;
+#endif
+            }
+        }
+
+        /// <summary>
+        /// Gets a reference to an element at a specified offset with respect to <see cref="Value"/>.
+        /// </summary>
+        /// <param name="offset">The offset of the element to retrieve, starting from the reference provided by <see cref="Value"/>.</param>
+        /// <remarks>
+        /// This indexer offers a layer of abstraction over <see cref="Unsafe.Add{T}(ref T,IntPtr)"/>, and similarly it does
+        /// not do any kind of input validation. It is responsability of the caller to ensure the supplied offset is valid.
+        /// </remarks>
+        public ref T this[nint offset]
+        {
+            [MethodImpl(MethodImplOptions.AggressiveInlining)]
+            get
+            {
+#if NETCORE_RUNTIME
+                return ref Unsafe.Add(ref ByReference.Value, offset);
+#elif SPAN_RUNTIME_SUPPORT
+                return ref Unsafe.Add(ref MemoryMarshal.GetReference(Span), offset);
+#else
+                ref T r0 = ref Owner.DangerousGetObjectDataReferenceAt<T>(Offset);
+                ref T r1 = ref Unsafe.Add(ref r0, offset);
+
+                return ref r1;
+#endif
+            }
+        }
+
+#if SPAN_RUNTIME_SUPPORT
+        /// <summary>
+        /// Explicitly converts a <see cref="NullableRef{T}"/> instance into a <see cref="Ref{T}"/> one.
+        /// </summary>
+        /// <param name="reference">The input <see cref="NullableRef{T}"/> instance.</param>
+        /// <exception cref="InvalidOperationException">
+        /// Thrown if <paramref name="reference"/> has the <see cref="NullableRef{T}.HasValue"/> property set to <see langword="false"/>.
+        /// </exception>
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public static explicit operator Ref<T>(NullableRef<T> reference)
+        {
+            return new Ref<T>(ref reference.Value);
         }
 #endif
 
@@ -99,5 +199,15 @@ public static implicit operator T(Ref<T> reference)
         {
             return reference.Value;
         }
+
+#if SPAN_RUNTIME_SUPPORT
+        /// <summary>
+        /// Throws an <see cref="ArgumentException"/> when trying to create a <see cref="Ref{T}"/> from a pointer to a managed type.
+        /// </summary>
+        private static void ThrowArgumentExceptionForInvalidType()
+        {
+            throw new ArgumentException("The Ref<T>(void*) constructor can only be used when T is an unmanaged type");
+        }
+#endif
     }
 }
diff --git a/System.Private.CoreLib/ByReference{T}.cs b/System.Private.CoreLib/ByReference{T}.cs
new file mode 100644
index 00000000000..37298d27a72
--- /dev/null
+++ b/System.Private.CoreLib/ByReference{T}.cs
@@ -0,0 +1,51 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+// ======================
+// NOTE
+// ======================
+// This project is only meant to be used by the Microsoft.Toolkit.HighPerformance
+// package, which has special handling to ensure the ByReference<T> type is only
+// imported and accessed on supported runtimes. Do not reference this project
+// from other packages in the toolkit, as it will not work correctly there.
+
+namespace System
+{
+    /// <summary>
+    /// This type is meant to be used to represent "ref T" fields. It is working around lack of first class
+    /// support for byref fields in C# and IL. The JIT and type loader has special handling for it that turns
+    /// it into a thin wrapper around ref T. This type is ported from CoreCLR, see original source
+    /// <see href="https://github.com/dotnet/runtime/blob/master/src/libraries/System.Private.CoreLib/src/System/ByReference.cs">here</see>.
+    /// </summary>
+    /// <typeparam name="T">The type of reference being stored.</typeparam>
+    internal readonly ref struct ByReference<T>
+    {
+#pragma warning disable IDE0051, 169 // Unused local field
+        private readonly IntPtr value;
+#pragma warning restore IDE0051, 169
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="ByReference{T}"/> struct.
+        /// </summary>
+        /// <param name="value">The reference to the target <typeparamref name="T"/> value.</param>
+        public ByReference(ref T value)
+        {
+            // Implemented as a JIT intrinsic - This default implementation is for
+            // completeness and to provide a concrete error if called via reflection
+            // or if intrinsic is missed.
+            throw new PlatformNotSupportedException();
+        }
+
+        /// <summary>
+        /// Gets the <typeparamref name="T"/> reference represented by the current <see cref="ByReference{T}"/> instance.
+        /// </summary>
+        public ref T Value
+        {
+            // Implemented as a JIT intrinsic - This default implementation is for
+            // completeness and to provide a concrete error if called via reflection
+            // or if the intrinsic is missed.
+            get => throw new PlatformNotSupportedException();
+        }
+    }
+}
diff --git a/System.Private.CoreLib/Directory.Build.props b/System.Private.CoreLib/Directory.Build.props
new file mode 100644
index 00000000000..6dc4195c320
--- /dev/null
+++ b/System.Private.CoreLib/Directory.Build.props
@@ -0,0 +1 @@
+<Project/>
\ No newline at end of file
diff --git a/System.Private.CoreLib/Directory.Build.targets b/System.Private.CoreLib/Directory.Build.targets
new file mode 100644
index 00000000000..6dc4195c320
--- /dev/null
+++ b/System.Private.CoreLib/Directory.Build.targets
@@ -0,0 +1 @@
+<Project/>
\ No newline at end of file
diff --git a/System.Private.CoreLib/Properties/AssemblyInfo.cs b/System.Private.CoreLib/Properties/AssemblyInfo.cs
new file mode 100644
index 00000000000..134b5aa54a7
--- /dev/null
+++ b/System.Private.CoreLib/Properties/AssemblyInfo.cs
@@ -0,0 +1,14 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System.Runtime.CompilerServices;
+
+// The ByReference<T> type included in this project is kept internal, so
+// that users referencing the Microsoft.Toolkit.HighPerformance package will
+// need to go through the (overhead free) abstraction of the Ref<T> types
+// present in that assembly. This makes codebases using this package more
+// resilient to changes in the runtime, and the code itself more portable.
+// We need to provide the full public key here, as this assembly is signed.
+// See the .csproj file for more info on why this is needed.
+[assembly: InternalsVisibleTo("Microsoft.Toolkit.HighPerformance, PublicKey=002400000480000094000000060200000024000052534131000400000100010041753af735ae6140c9508567666c51c6ab929806adb0d210694b30ab142a060237bc741f9682e7d8d4310364b4bba4ee89cc9d3d5ce7e5583587e8ea44dca09977996582875e71fb54fa7b170798d853d5d8010b07219633bdb761d01ac924da44576d6180cdceae537973982bb461c541541d58417a3794e34f45e6f2d129e2")]
diff --git a/System.Private.CoreLib/SilverlightPlatformPublicKey.snk b/System.Private.CoreLib/SilverlightPlatformPublicKey.snk
new file mode 100644
index 00000000000..60146e8891a
Binary files /dev/null and b/System.Private.CoreLib/SilverlightPlatformPublicKey.snk differ
diff --git a/System.Private.CoreLib/System.Private.CoreLib.csproj b/System.Private.CoreLib/System.Private.CoreLib.csproj
new file mode 100644
index 00000000000..a4d1ac05777
--- /dev/null
+++ b/System.Private.CoreLib/System.Private.CoreLib.csproj
@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>netcoreapp2.1</TargetFramework>
+    <AssemblyName>System.Private.CoreLib</AssemblyName>
+    <Version>4.0.0.0</Version>
+    <RootNamespace>System</RootNamespace>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+
+    <!-- We sign the assembly using the same key in use from the actual
+         System.Private.CoreLib. This is not strictly necessary due to
+         the loosened assembly binding system (compared to .NET Framework),
+         but we include this step for completeness. This is the same reason
+         why the Build.props and .targets file are overwritten in this project,
+         so that we can specify the assembly version and key manually. -->
+    <SignAssembly>true</SignAssembly>
+    <AssemblyOriginatorKeyFile>SilverlightPlatformPublicKey.snk</AssemblyOriginatorKeyFile>
+    <PublicSign>true</PublicSign>
+
+    <!-- We don't want a NuGet package being generated from this project.
+         The fake System.Private.CoreLib assembly is only referenced
+         internally by the Microsoft.Toolkit.HighPerformance package. -->
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+</Project>
diff --git a/UnitTests/UnitTests.HighPerformance.Shared/Test_NullableReadOnlyRef{T}.cs b/UnitTests/UnitTests.HighPerformance.Shared/Test_NullableReadOnlyRef{T}.cs
index 97b00fe1d48..09a8fa14a30 100644
--- a/UnitTests/UnitTests.HighPerformance.Shared/Test_NullableReadOnlyRef{T}.cs
+++ b/UnitTests/UnitTests.HighPerformance.Shared/Test_NullableReadOnlyRef{T}.cs
@@ -2,7 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
-#if NETCOREAPP3_1
+#if NETCOREAPP2_1 || NETCOREAPP3_1
 
 using System;
 using System.Diagnostics.CodeAnalysis;
@@ -12,6 +12,12 @@
 
 namespace UnitTests.HighPerformance
 {
+    /* ====================================================================
+     *                                 NOTE
+     * ====================================================================
+     * All thests here mirror the ones for NullableRef<T>, as the two types
+     * are the same except for the fact that this wraps a readonly ref. See
+     * comments in the NullableRef<T> test file for more info on these tests. */
     [TestClass]
     [SuppressMessage("StyleCop.CSharp.DocumentationRules", "SA1649", Justification = "Test class for generic type")]
     public class Test_NullableReadOnlyRefOfT
diff --git a/UnitTests/UnitTests.HighPerformance.Shared/Test_NullableRef{T}.cs b/UnitTests/UnitTests.HighPerformance.Shared/Test_NullableRef{T}.cs
index cc86c5bb3eb..f9f737eca5e 100644
--- a/UnitTests/UnitTests.HighPerformance.Shared/Test_NullableRef{T}.cs
+++ b/UnitTests/UnitTests.HighPerformance.Shared/Test_NullableRef{T}.cs
@@ -2,7 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
-#if NETCOREAPP3_1
+#if NETCOREAPP2_1 || NETCOREAPP3_1
 
 using System;
 using System.Diagnostics.CodeAnalysis;
@@ -23,6 +23,9 @@ public void Test_NullableRefOfT_CreateNullableRefOfT_Ok()
             int value = 1;
             var reference = new NullableRef<int>(ref value);
 
+            // Create a NullableRef<T> to a local, then validate that the ref
+            // has value (as in, the ref T is not null), and that the reference
+            // does match and correctly points to the local variable above.
             Assert.IsTrue(reference.HasValue);
             Assert.IsTrue(Unsafe.AreSame(ref value, ref reference.Value));
 
@@ -35,6 +38,8 @@ public void Test_NullableRefOfT_CreateNullableRefOfT_Ok()
         [TestMethod]
         public void Test_NullableRefOfT_CreateNullableRefOfT_Null()
         {
+            // Validate that different methods of creating a nullable ref
+            // are all correctly reported as not having a valid value.
             Assert.IsFalse(default(NullableRef<int>).HasValue);
             Assert.IsFalse(NullableRef<int>.Null.HasValue);
 
@@ -49,6 +54,11 @@ public void Test_NullableRefOfT_CreateNullableRefOfT_Null_Exception()
         {
             NullableRef<int> reference = default;
 
+            // We try to access the value to trigger the null reference check within the
+            // NullableRef<T> type. The type should correctly detect that a null reference
+            // is wrapped, and throw an InvalidOperationException (not a NullReferenceException).
+            // This is consistent with how Nullable<T> works in the BCL as well (the type that
+            // is used to represent nullable value types).
             _ = reference.Value;
         }
 
@@ -60,6 +70,8 @@ public void Test_NullableRefOfT_CreateNullableRefOfT_ImplicitRefCast()
             var reference = new Ref<int>(ref value);
             NullableRef<int> nullableRef = reference;
 
+            // Verify that the inplicit Ref<T> ==> NullableRef<T> conversion works properly.
+            // The value should be available, and the internal ref should remain the same.
             Assert.IsTrue(nullableRef.HasValue);
             Assert.IsTrue(Unsafe.AreSame(ref reference.Value, ref nullableRef.Value));
         }
@@ -71,6 +83,9 @@ public void Test_NullableRefOfT_CreateNullableRefOfT_ExplicitCastOfT()
             int value = 42;
             var reference = new NullableRef<int>(ref value);
 
+            // Test the value equality by using the implicit T operator for NullableRef<T>.
+            // As in, just like with normal refs, NullableRef<T> has automatic dereferencing,
+            // and when cast to T it will dereference the internal ref and return th T value.
             Assert.AreEqual(value, (int)reference);
         }
 
@@ -81,6 +96,9 @@ public void Test_NullableRefOfT_CreateNullableRefOfT_ExplicitCastOfT_Exception()
         {
             NullableRef<int> invalid = default;
 
+            // Same as above, but trying to dereference should throw an InvalidOperationException
+            // since our NullableRef<T> here wraps a null reference. The value is discarded because
+            // here we just need to trigger the implicit operator to verify the exception is thrown.
             _ = (int)invalid;
         }
     }
diff --git a/UnitTests/UnitTests.HighPerformance.Shared/Test_ReadOnlyRef{T}.cs b/UnitTests/UnitTests.HighPerformance.Shared/Test_ReadOnlyRef{T}.cs
index 106b6c95892..37d09ce93e8 100644
--- a/UnitTests/UnitTests.HighPerformance.Shared/Test_ReadOnlyRef{T}.cs
+++ b/UnitTests/UnitTests.HighPerformance.Shared/Test_ReadOnlyRef{T}.cs
@@ -2,21 +2,29 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+using System;
 using System.Diagnostics.CodeAnalysis;
+using System.Diagnostics.Contracts;
 using System.Runtime.CompilerServices;
 using Microsoft.Toolkit.HighPerformance;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
 
 namespace UnitTests.HighPerformance
 {
+    /* ==================================================================
+     *                                NOTE
+     * ==================================================================
+     * All thests here mirror the ones for Ref<T>, as the two types are
+     * the same except for the fact that this wraps a readonly ref. See
+     * comments in the Ref<T> test file for more info on these tests. */
     [TestClass]
     [SuppressMessage("StyleCop.CSharp.DocumentationRules", "SA1649", Justification = "Test class for generic type")]
     public class Test_ReadOnlyRefOfT
     {
+#if WINDOWS_UWP
         [TestCategory("ReadOnlyRefOfT")]
         [TestMethod]
-#if WINDOWS_UWP
-        public void Test_RefOfT_CreateRefOfT()
+        public void Test_ReadOnlyRefOfT_CreateReadOnlyRefOfT()
         {
             var model = new ReadOnlyFieldOwner();
             var reference = new ReadOnlyRef<int>(model, model.Value);
@@ -32,14 +40,62 @@ private sealed class ReadOnlyFieldOwner
             [SuppressMessage("StyleCop.CSharp.MaintainabilityRules", "SA1401", Justification = "Ref readonly access for tests")]
             public readonly int Value = 1;
         }
+
+        [Pure]
+        private static ReadOnlyRef<T> CreateReadOnlyRefFromArray<T>(T[] array)
+        {
+            return new ReadOnlyRef<T>(array, array[0]);
+        }
 #else
-        public void Test_RefOfT_CreateRefOfT()
+        [TestCategory("ReadOnlyRefOfT")]
+        [TestMethod]
+        public void Test_ReadOnlyRefOfT_CreateReadOnlyRefOfT()
         {
             int value = 1;
             var reference = new ReadOnlyRef<int>(value);
 
             Assert.IsTrue(Unsafe.AreSame(ref value, ref Unsafe.AsRef(reference.Value)));
         }
+
+        [Pure]
+        private static ReadOnlyRef<T> CreateReadOnlyRefFromArray<T>(T[] array)
+        {
+            return new ReadOnlyRef<T>(array[0]);
+        }
+
+        [TestCategory("ReadOnlyRefOfT")]
+        [TestMethod]
+        public unsafe void Test_ReadOnlyRefOfT_CreateReadOnlyRefOfTFromPointer_Ok()
+        {
+            int value = 1;
+            var reference = new ReadOnlyRef<int>(&value);
+
+            Assert.IsTrue(Unsafe.AreSame(ref value, ref Unsafe.AsRef(reference.Value)));
+        }
+
+        [TestCategory("ReadOnlyRefOfT")]
+        [TestMethod]
+        [ExpectedException(typeof(ArgumentException))]
+        public unsafe void Test_ReadOnlyRefOfT_CreateReadOnlyRefOfTFrompointer_Fail()
+        {
+            var reference = new ReadOnlyRef<string>((void*)0);
+
+            Assert.Fail();
+        }
 #endif
+
+        [TestCategory("ReadOnlyRefOfT")]
+        [TestMethod]
+        public void Test_ReadOnlyRefOfT_DangerousGetReferenceAt()
+        {
+            int[] array = { 1, 2, 3, 4, 5 };
+            ReadOnlyRef<int> reference = CreateReadOnlyRefFromArray(array);
+
+            Assert.IsTrue(Unsafe.AreSame(ref array[0], ref reference.DangerousGetReference()));
+            Assert.IsTrue(Unsafe.AreSame(ref array[3], ref Unsafe.AsRef(reference[3])));
+            Assert.IsTrue(Unsafe.AreSame(ref array[3], ref Unsafe.AsRef(reference[(IntPtr)3])));
+            Assert.IsTrue(Unsafe.AreSame(ref array[3], ref reference.DangerousGetReferenceAt(3)));
+            Assert.IsTrue(Unsafe.AreSame(ref array[3], ref reference.DangerousGetReferenceAt((IntPtr)3)));
+        }
     }
 }
diff --git a/UnitTests/UnitTests.HighPerformance.Shared/Test_Ref{T}.cs b/UnitTests/UnitTests.HighPerformance.Shared/Test_Ref{T}.cs
index 556649c3cf6..29dc5bfab31 100644
--- a/UnitTests/UnitTests.HighPerformance.Shared/Test_Ref{T}.cs
+++ b/UnitTests/UnitTests.HighPerformance.Shared/Test_Ref{T}.cs
@@ -2,7 +2,9 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+using System;
 using System.Diagnostics.CodeAnalysis;
+using System.Diagnostics.Contracts;
 using System.Runtime.CompilerServices;
 using Microsoft.Toolkit.HighPerformance;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
@@ -13,18 +15,21 @@ namespace UnitTests.HighPerformance
     [SuppressMessage("StyleCop.CSharp.DocumentationRules", "SA1649", Justification = "Test class for generic type")]
     public class Test_RefOfT
     {
+#if WINDOWS_UWP
         [TestCategory("RefOfT")]
         [TestMethod]
-#if WINDOWS_UWP
         public void Test_RefOfT_CreateRefOfT()
         {
             var model = new FieldOwner { Value = 1 };
             var reference = new Ref<int>(model, ref model.Value);
 
+            // Create a Ref<T> wrapping a ref to a field in an object and validate that
+            // the returned ref does indeed match one to that field directly.
             Assert.IsTrue(Unsafe.AreSame(ref model.Value, ref reference.Value));
 
             reference.Value++;
 
+            // We increment the ref, and then verify the target field was updated correctly
             Assert.AreEqual(model.Value, 2);
         }
 
@@ -36,18 +41,81 @@ private sealed class FieldOwner
             [SuppressMessage("StyleCop.CSharp.MaintainabilityRules", "SA1401", Justification = "Quick ref access for tests")]
             public int Value;
         }
+
+        // Helper method that creates a Ref<T> to the first item of a T[] array, on UWP. In this
+        // case (portable version) we need to use both the target object, and an interior reference.
+        [Pure]
+        private static Ref<T> CreateRefFromArray<T>(T[] array)
+        {
+            return new Ref<T>(array, ref array[0]);
+        }
 #else
+        [TestCategory("RefOfT")]
+        [TestMethod]
         public void Test_RefOfT_CreateRefOfT()
         {
             int value = 1;
             var reference = new Ref<int>(ref value);
 
+            // Same as the UWP version above, but directly wrapping the target ref
+            Assert.IsTrue(Unsafe.AreSame(ref value, ref reference.Value));
+
+            reference.Value++;
+
+            Assert.AreEqual(value, 2);
+        }
+
+        // Same as above, but here we can directly wrap the target ref
+        [Pure]
+        private static Ref<T> CreateRefFromArray<T>(T[] array)
+        {
+            return new Ref<T>(ref array[0]);
+        }
+
+        [TestCategory("RefOfT")]
+        [TestMethod]
+        public unsafe void Test_RefOfT_CreateRefOfTFromPointer_Ok()
+        {
+            int value = 1;
+            var reference = new Ref<int>(&value);
+
+            // Same as above, but this time we wrap a raw pointer to a local instead
             Assert.IsTrue(Unsafe.AreSame(ref value, ref reference.Value));
 
             reference.Value++;
 
             Assert.AreEqual(value, 2);
         }
+
+        [TestCategory("RefOfT")]
+        [TestMethod]
+        [ExpectedException(typeof(ArgumentException))]
+        public unsafe void Test_RefOfT_CreateRefOfTFrompointer_Fail()
+        {
+            var reference = new Ref<string>((void*)0);
+
+            // Creating a Ref<T> from a pointer when T is a managed type (eg. string) is not
+            // allowed (this is consistent with APIs from the BCL such as Span<T>). So the
+            // constructor above should always throw an ArgumentException.
+            Assert.Fail();
+        }
 #endif
+
+        [TestCategory("RefOfT")]
+        [TestMethod]
+        public void Test_RefOfT_DangerousGetReferenceAt()
+        {
+            int[] array = { 1, 2, 3, 4, 5 };
+            Ref<int> reference = CreateRefFromArray(array);
+
+            // We created a Ref<T> pointing to the first item of the target array, so here
+            // we test a number of ref accesses (both directly to the target ref, as well as
+            // using the helper indexers to do pointer arithmetic) to validate their results.
+            // Doing Ref<T>[i] is conceptually eqivalent to doing p[i] on a given T* pointer,
+            // so here we compare these offsetting operations with refs from the target array.
+            Assert.IsTrue(Unsafe.AreSame(ref array[0], ref reference.Value));
+            Assert.IsTrue(Unsafe.AreSame(ref array[3], ref reference[3]));
+            Assert.IsTrue(Unsafe.AreSame(ref array[3], ref reference[(IntPtr)3]));
+        }
     }
 }
diff --git a/Windows Community Toolkit.sln b/Windows Community Toolkit.sln
index dbb8ef27886..db16d9d9f79 100644
--- a/Windows Community Toolkit.sln	
+++ b/Windows Community Toolkit.sln	
@@ -1,4 +1,3 @@
-
 Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio Version 16
 VisualStudioVersion = 16.0.29230.61
@@ -112,6 +111,8 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Docs", "Docs", "{88C6FFBE-3
 		ThirdPartyNotices.txt = ThirdPartyNotices.txt
 	EndProjectSection
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "System.Private.CoreLib", "System.Private.CoreLib\System.Private.CoreLib.csproj", "{5F66DDCC-2F40-43C1-902E-2C1F887DB650}"
+EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.Toolkit.Uwp.UI.Controls.Markdown", "Microsoft.Toolkit.Uwp.UI.Controls.Markdown\Microsoft.Toolkit.Uwp.UI.Controls.Markdown.csproj", "{6FEDF199-B052-49DD-8F3E-2A9224998E0F}"
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.Toolkit.Uwp.UI.Controls.Markdown.Design", "Microsoft.Toolkit.Uwp.UI.Controls.Markdown.Design\Microsoft.Toolkit.Uwp.UI.Controls.Markdown.Design.csproj", "{67FE47A0-CA93-4680-B770-A0A48C1DBC40}"
@@ -851,6 +852,36 @@ Global
 		{804D0681-52F6-4E61-864A-699F0AB44B20}.Release|x86.ActiveCfg = Release|x86
 		{804D0681-52F6-4E61-864A-699F0AB44B20}.Release|x86.Build.0 = Release|x86
 		{804D0681-52F6-4E61-864A-699F0AB44B20}.Release|x86.Deploy.0 = Release|x86
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Debug|ARM.ActiveCfg = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Debug|ARM.Build.0 = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Debug|ARM64.ActiveCfg = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Debug|ARM64.Build.0 = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Debug|x64.Build.0 = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Debug|x86.Build.0 = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Native|Any CPU.ActiveCfg = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Native|Any CPU.Build.0 = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Native|ARM.ActiveCfg = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Native|ARM.Build.0 = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Native|ARM64.ActiveCfg = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Native|ARM64.Build.0 = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Native|x64.ActiveCfg = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Native|x64.Build.0 = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Native|x86.ActiveCfg = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Native|x86.Build.0 = Debug|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Release|Any CPU.Build.0 = Release|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Release|ARM.ActiveCfg = Release|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Release|ARM.Build.0 = Release|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Release|ARM64.ActiveCfg = Release|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Release|ARM64.Build.0 = Release|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Release|x64.ActiveCfg = Release|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Release|x64.Build.0 = Release|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Release|x86.ActiveCfg = Release|Any CPU
+		{5F66DDCC-2F40-43C1-902E-2C1F887DB650}.Release|x86.Build.0 = Release|Any CPU
 		{6FEDF199-B052-49DD-8F3E-2A9224998E0F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{6FEDF199-B052-49DD-8F3E-2A9224998E0F}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{6FEDF199-B052-49DD-8F3E-2A9224998E0F}.Debug|ARM.ActiveCfg = Debug|Any CPU