It's not just a pointer, but a pointer + metadata.

See this paper for details: https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/201904...