Box operation can operate on ValueType but not all of them.
Below example is trying to box System.ArgIterator. ArgIterator can have pointer points to stack, therefor BOX it won't be verifiable.
.method public hidebysig static vararg void VarArg() cil managed { .maxstack 8 .locals init ( [0] valuetype [mscorlib]System.ArgIterator args) L_0000: ldloca args L_0004: arglist L_0006: call instance void [mscorlib]System.ArgIterator::.ctor(valuetype [mscorlib]System.RuntimeArgumentHandle) L_000b: ldloc args L_000f: box [mscorlib]System.ArgIterator L_0014: unbox [mscorlib]System.ArgIterator L_0019: call instance valuetype [mscorlib]System.TypedReference [mscorlib]System.ArgIterator::GetNextArg() L_001e: refanyval int64 L_0023: ldind.i8 L_0024: call void [mscorlib]System.Console::WriteLine(int64) L_0029: ret }
Here is the PEVerify result.[IL]: Error: [xxx.exe : TestClass::VarArg][mdToken=0x6000001][offset 0x0000000F][found value 'System.ArgIterator'] Value type, ObjRef type or variable type expected.(Error: 0x801318C0)