I thought I knew what is box and unbox. After reading the ECMA spec, I know that what I believed was actually wrong. Maybe you had the same incorrect impression in your mind.
Box a integer will create an object on the heap and copy the date from valuetype into the newly allocated object. It then put the object on the stack.
What will unbox do? I thought it will do the reverse of "boxing"; copying the valuetype back to the stack from the boxed object. According to the ECMA spec, it will actually compues the address of the valuetype and make it a managed Pointer.
Since the net result of unbox returns a managed pointer not the valuetype ifself. Sometime it is unverifable if you try to return the managed pointer to the caller.