How To Map Double-C-struct-pointer In C#?

I have the following C-calls to libACL:

extern int acl_get_entry(acl_t acl, int entry_id, acl_entry_t *entry_p);
extern int acl_get_permset(acl_entry_t entry_d, acl_permset_t *permset_p);

And I've tracked the typedefs to

typedef struct __acl_permset_ext *acl_permset_t;
typedef struct __acl_entry_ext  *acl_entry_t;
typedef struct __acl_ext *acl_t;

in /usr/include/acl/libacl.h and /usr/include/sys/acl.h

So unless I made an error, this means the above native calls are equivalent to:

extern int acl_get_entry(__acl_ext *acl, int entry_id, __acl_entry_ext **entry_p);
extern int acl_get_permset(__acl_ext *entry_d, __acl_permset_ext **permset_p);

Now I'm a bit at a loss about how to map these to C#...
I first thought I could just do this:

// extern int acl_get_entry(acl_t acl, int entry_id, acl_entry_t *entry_p);
[SuppressUnmanagedCodeSecurity]
[DllImport("acl", CallingConvention = System.Runtime.InteropServices.CallingConvention.Cdecl, EntryPoint = "acl_get_entry")]
internal static extern int acl_get_entry(__acl_ext* acl, AclEntryConstants entry_id, ref __acl_entry_ext entry_p); // Double pointer, correct ???

And that even works, at least apparently.
But when I do the same with acl_get_permset

// extern int acl_get_permset(acl_entry_t entry_d, acl_permset_t *permset_p);
[SuppressUnmanagedCodeSecurity]
[DllImport("acl", CallingConvention = System.Runtime.InteropServices.CallingConvention.Cdecl,
   EntryPoint = "acl_get_permset")]
internal static extern int acl_get_permset(__acl_entry_ext* entry_d, __acl_permset_ext** permset_p); // double pointer ?

aka

internal static extern int acl_get_permset(__acl_entry_ext* entry_d, ref __acl_permset_ext permset_p); // double pointer ?

Then it doesn't work...

I have written the following C-code to check:

int main()
{
   // Get all the entries
   acl_entry_t acl_entry_;
   acl_permset_t permission_set;
   acl_tag_t acl_kind_tag;

   const char* _filename = "/root/Desktop/CppSharp.txt";
   acl_t acl_file = acl_get_file(_filename, ACL_TYPE_ACCESS);
   int found = acl_get_entry(acl_file, ACL_FIRST_ENTRY, &acl_entry_);


   int a = acl_get_permset(acl_entry_, &permission_set);
   int b = acl_get_tag_type(acl_entry_, &acl_kind_tag);
   printf("a: %d; b: %d\n", a, b);

   acl_entry new_acl;
   new_acl.reading = ACL_GET_PERM(permission_set, ACL_READ);
   new_acl.writing = ACL_GET_PERM(permission_set, ACL_WRITE);
   new_acl.execution = ACL_GET_PERM(permission_set, ACL_EXECUTE);


   return 0;
}

and that returns a non -1 value for a and b.
But my C# code, which does exactly the same (or so I thought), gets to int found = 1 (just like C), but then it returns -1 for a and b...

static unsafe void ReadACL()
{
   string fileName = "/root/Desktop/CppSharp.txt";
  
   global::acl.__acl_ext* acl_file = NativeMethods.acl_get_file(fileName, global::acl.acl_type_t.ACL_TYPE_ACCESS);


   global::acl.__acl_entry_ext acl_entry_ = new global::acl.__acl_entry_ext();
   int found = NativeMethods.acl_get_entry(acl_file, global::acl.AclEntryConstants.ACL_FIRST_ENTRY, ref acl_entry_);
   System.Console.WriteLine(found);


   global::acl.__acl_permset_ext permission_set;
   acl_tag_t acl_kind_tag = acl_tag_t.ACL_UNDEFINED_TAG;
  
  
   int a = NativeMethods.acl_get_permset(&acl_entry_, &permission_set);
   global::acl.acl_tag_t tag_type = acl_tag_t.ACL_UNDEFINED_TAG;
   int b = NativeMethods.acl_get_tag_type(&acl_entry_, &tag_type);

   System.Console.WriteLine($"{a} {b}");

Also, the strangest thing - I've searched the following header files:

/usr/include/acl/libacl.h 
/usr/include/sys/acl.h

and the entire /usr/include folder for __acl_permset_ext and __acl_entry_ext, but I needed to google them, as they are nowhere defined... Does the C-Compiler just use pointers, without needing the structs at all ?

Also, prior to doing it manually, I've tried to create the bindings automatically with CppSharp, but these auto-generated bindings had the very same issue...

mono ./CppSharp.CLI.exe --arch=x64 --output=/home/username/RiderProjects/TestProject/TestProject/AUTOMAPPED/  /usr/include/acl/libacl.h /usr/include/sys/acl.h

And one more thing I noticed: What sense does it make to pass a double-pointer ? That's like

struct x;
function(ref &x)

which makes very little sense IMHO, as your passing the address by reference.
Are these perhaps arrays ?
Like

struct[] x;
function(ref x)

Here are the constants:

// #define ACL_UNDEFINED_ID    ((id_t)-1)

// acl_check error codes
public enum acl_check_errors
   : int
{
    ACL_MULTI_ERROR = (0x1000), // multiple unique objects
    ACL_DUPLICATE_ERROR = (0x2000), // duplicate Id's in entries
    ACL_MISS_ERROR = (0x3000), // missing required entry
    ACL_ENTRY_ERROR = (0x4000) // wrong entry type 
}


// 23.2.2 acl_perm_t values
public enum acl_perm_t
   : uint
{
   ACL_READ = (0x04),
   ACL_WRITE = (0x02),
   ACL_EXECUTE = (0x01),
   // ACL_ADD = (0x08),
   // ACL_DELETE = (0x10),
}


// 23.2.5 acl_tag_t values
public enum acl_tag_t
   : int
{
   ACL_UNDEFINED_TAG = (0x00),
   ACL_USER_OBJ = (0x01),
   ACL_USER = (0x02),
   ACL_GROUP_OBJ = (0x04),
   ACL_GROUP = (0x08),
   ACL_MASK = (0x10),
   ACL_OTHER = (0x20)
}

public enum acl_type_t
   : uint
{
   ACL_TYPE_ACCESS = (0x8000),
   ACL_TYPE_DEFAULT = (0x4000)
}   
// 23.2.8 ACL Entry Constants
public enum AclEntryConstants
   : int
{
   ACL_FIRST_ENTRY = 0,
   ACL_NEXT_ENTRY = 1,
}

And this are the structs that I googled together:

// https://kernel.googlesource.com/pub/scm/fs/ext2/xfstests-bld/+/301faaf37f99fc30105f261f23d44e2a0632ffc0/acl/libacl/libobj.h
// https://kernel.googlesource.com/pub/scm/fs/ext2/xfstests-bld/+/301faaf37f99fc30105f261f23d44e2a0632ffc0/acl/libacl/libobj.h
// https://kernel.googlesource.com/pub/scm/fs/ext2/xfstests-bld/+/301faaf37f99fc30105f261f23d44e2a0632ffc0/acl/libacl/libacl.h
// https://allstar.jhuapl.edu/repo/p1/amd64/acl/libacl.h
// https://kernel.googlesource.com/pub/scm/fs/ext2/xfstests-bld/+/301faaf37f99fc30105f261f23d44e2a0632ffc0/acl/libacl/libacl.h
// https://kernel.googlesource.com/pub/scm/fs/ext2/xfstests-bld/+/301faaf37f99fc30105f261f23d44e2a0632ffc0/acl/libacl/acl_get_fd.c


[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
public unsafe struct obj_prefix
{
   public ulong p_magic;
   public ulong p_flags;
}

// typedef struct __acl_permset_ext *acl_permset_t;
[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
public unsafe struct __acl_permset_ext
{
   // permset_t      s_perm; // typedef unsigned int permset_t;
   public uint s_perm;
};

// typedef struct acl_permset_obj_tag acl_permset_obj;
[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
public unsafe struct acl_permset_obj_tag
{
   public obj_prefix o_prefix;
   public __acl_permset_ext i;
};

// #define __U32_TYPE     unsigned int
// #define __ID_T_TYPE    __U32_TYPE
// __STD_TYPE __ID_T_TYPE __id_t;     /* General type for IDs.  */
// typedef __id_t id_t;

/* qualifier object */
[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
public unsafe struct __qualifier_ext
{
   //id_t                    q_id;
   public uint q_id;
}

[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
public unsafe struct qualifier_obj_tag
{
   public obj_prefix o_prefix;
   public __qualifier_ext i;
}


[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
public unsafe struct acl_entry_obj_tag
{
   public obj_prefix o_prefix;
   public __acl_entry_ext i;
}


// typedef struct __acl_ext    *acl_t;
[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
public unsafe struct __acl_ext
{
   // typedef struct acl_entry_obj_tag acl_entry_obj;
   // acl_entry_obj      *a_prev, *a_next;
   // acl_entry_obj      *a_curr;
   // acl_entry_obj      *a_prealloc, *a_prealloc_end;

   public acl_entry_obj_tag* a_prev;
   public acl_entry_obj_tag* a_next;
   public acl_entry_obj_tag* a_curr;
   public acl_entry_obj_tag* a_prealloc;

   public acl_entry_obj_tag* a_prealloc_end;

   // size_t a_used; // typedef __SIZE_TYPE__ size_t;
   public ulong a_used;
}


[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
public unsafe struct acl_obj_tag
{
   public obj_prefix o_prefix;
   public __acl_ext i;
}


[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
public unsafe struct __acl_entry
{
   acl_tag_t e_tag;

   // qualifier_obj      e_id; // typedef struct qualifier_obj_tag qualifier_obj;
   qualifier_obj_tag e_id;

   // acl_permset_obj    e_perm;  //typedef struct acl_permset_obj_tag acl_permset_obj;
   acl_permset_obj_tag e_perm;
}


// typedef struct __acl_entry_ext  *acl_entry_t;
[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
public unsafe struct __acl_entry_ext
{
   // acl_entry_obj      *e_prev, *e_next; // typedef struct acl_entry_obj_tag acl_entry_obj;
   public acl_entry_obj_tag* e_prev;

   public acl_entry_obj_tag* e_next;

   // acl_obj       *e_container; // typedef struct acl_obj_tag acl_obj;
   public acl_obj_tag* e_container;
   public __acl_entry e_entry;
}

From looking here, those ACL types are defined as:

struct __acl_ext;
struct __acl_entry_ext;
struct __acl_permset_ext;

typedef struct __acl_ext    *acl_t;
typedef struct __acl_entry_ext  *acl_entry_t;
typedef struct __acl_permset_ext *acl_permset_t;

We've been told that the struct __acl_ext exists, but we don't get to see how it's defined: we don't know what fields it has. Obviously it's properly defined in another (private) header or source file, but we don't have visibility to those: they're private.

On the face of it this seems like a problem: how can we use these structs if we don't know how large they are, or how their fields are laid out? Look further, and you can see that we only ever interact with pointers to these structs: ACL functions will give us back a pointer, which we can then pass to other ACL functions. We're never expected to dereference the pointers ourselves. The ACL code of course knows what the pointers point to, but that's hidden from us.

This is called an opaque pointer.

(This can be a useful strategy. For example, it lets the ACL library change how the struct is defined without breaking consumers. It also stops us from changing fields in these structs directly, which might break the ACL library).

So. We shouldn't be trying to define C# types for these structs at all: we're very much not meant to be doing that. The C# type for an opaque pointer is IntPtr, so let's use that:

// extern int acl_get_entry(acl_t acl, int entry_id, acl_entry_t *entry_p);
[SuppressUnmanagedCodeSecurity]
[DllImport("acl", CallingConvention = CallingConvention.Cdecl, EntryPoint = "acl_get_entry")]
internal static extern int acl_get_entry(IntPtr acl, AclEntryConstants entry_id, out IntPtr entry_p);

// extern int acl_get_permset(acl_entry_t entry_d, acl_permset_t *permset_p);
[SuppressUnmanagedCodeSecurity]
[DllImport("acl", CallingConvention = CallingConvention.Cdecl, EntryPoint = "acl_get_permset")]
internal static extern int acl_get_permset(IntPtr entry_d, out IntPtr permset_p);

We could use ref or out for the IntPtr. Reading the docs, it looks like the C code never reads the value of the double pointer you pass in: it just uses it as a way of passing a pointer back out. Therefore we use out.