I use 3rd party COM to find faces in a picture. One of the methods has the following signature, from SDK:

long FindMultipleFaces(
  IUnknown* pIDibImage,
  VARIANTARG* FacePositionArray
);

Parameters: pIDibImage[in] - The image to search.

FacePositionArray[out]- The array of FacePosition2 objects into which face information is placed. This array is in a safe array (VARIANT) of type VT_UNKNOWN. The size of the array dictates the maximum number of faces for which to search.

which translates into the following C# method signature (from metadata):

int FindMultipleFaces(object pIDibImage, ref object pIFacePositions);

Being optimistic I call it the following way but get an exception that the memory is corrupt. The exception is thrown only when a face is present in the image.

FacePosition2[] facePositions = new FacePosition2[10];
object positions = facePositions;
int faceCount = FaceLocator.FindMultipleFaces(dibImage, ref positions);

What's the right way to pass SAFEARRAY to unmanaged code?