diff --git a/src/AudioUnit/AUGraph.cs b/src/AudioUnit/AUGraph.cs
index b8c45325aa58..eaed2bec657b 100644
--- a/src/AudioUnit/AUGraph.cs
+++ b/src/AudioUnit/AUGraph.cs
@@ -88,7 +88,11 @@ internal AUGraph (NativeHandle handle, bool owns)
 
 		static IntPtr Create ()
 		{
-			int err = NewAUGraph (out var handle);
+			IntPtr handle;
+			int err;
+			unsafe {
+				err = NewAUGraph (&handle);
+			}
 			if (err != 0)
 				throw new InvalidOperationException (String.Format ("Cannot create new AUGraph. Error code: {0}", err));
 			return handle;
@@ -101,7 +105,10 @@ public AUGraph ()
 
 		public static AUGraph? Create (out int errorCode)
 		{
-			errorCode = NewAUGraph (out var handle);
+			IntPtr handle;
+			unsafe {
+				errorCode = NewAUGraph (&handle);
+			}
 
 			if (errorCode != 0)
 				return null;
@@ -483,7 +490,7 @@ protected override void Dispose (bool disposing)
 		}
 
 		[DllImport (Constants.AudioToolboxLibrary, EntryPoint = "NewAUGraph")]
-		static extern int /* OSStatus */ NewAUGraph (out IntPtr outGraph);
+		unsafe static extern int /* OSStatus */ NewAUGraph (IntPtr* outGraph);
 
 		[DllImport (Constants.AudioToolboxLibrary, EntryPoint = "AUGraphOpen")]
 		static extern int /* OSStatus */ AUGraphOpen (IntPtr inGraph);
diff --git a/src/ObjCRuntime/Selector.cs b/src/ObjCRuntime/Selector.cs
index 0a7bf45fb962..7643d6b42256 100644
--- a/src/ObjCRuntime/Selector.cs
+++ b/src/ObjCRuntime/Selector.cs
@@ -138,10 +138,21 @@ public static Selector Register (NativeHandle handle)
 		[DllImport (Messaging.LIBOBJC_DYLIB)]
 		extern static /* const char* */ IntPtr sel_getName (/* SEL */ IntPtr sel);
 
+		// objc/runtime.h
+		[DllImport (Messaging.LIBOBJC_DYLIB)]
+		extern static /* SEL */ IntPtr sel_registerName (/* const char* */ IntPtr name);
+
 		// objc/runtime.h
 		// Selector.GetHandle is optimized by the AOT compiler, and the current implementation only supports IntPtr, so we can't switch to NativeHandle quite yet (the AOT compiler crashes).
-		[DllImport (Messaging.LIBOBJC_DYLIB, EntryPoint = "sel_registerName")]
-		public extern static /* SEL */ IntPtr GetHandle (/* const char* */ string name);
+		public static IntPtr GetHandle (string name)
+		{
+			var ptr = Marshal.StringToHGlobalAnsi (name);
+			try {
+				return sel_registerName (ptr);
+			} finally {
+				Marshal.FreeHGlobal (ptr);
+			}
+		}
 
 		// objc/objc.h
 		[DllImport (Messaging.LIBOBJC_DYLIB)]
diff --git a/src/Security/Certificate.cs b/src/Security/Certificate.cs
index e6a5f0f23af9..43f77a4cfa22 100644
--- a/src/Security/Certificate.cs
+++ b/src/Security/Certificate.cs
@@ -1206,7 +1206,7 @@ public bool VerifySignature (SecKeyAlgorithm algorithm, NSData signedData, NSDat
 		[SupportedOSPlatform ("maccatalyst")]
 #endif
 		[DllImport (Constants.SecurityLibrary)]
-		static extern /* CFDataRef _Nullable */ IntPtr SecKeyCreateEncryptedData (/* SecKeyRef */ IntPtr key, /* SecKeyAlgorithm */ IntPtr algorithm, /* CFDataRef */ IntPtr plaintext, /* CFErrorRef* */ out IntPtr error);
+		unsafe static extern /* CFDataRef _Nullable */ IntPtr SecKeyCreateEncryptedData (/* SecKeyRef */ IntPtr key, /* SecKeyAlgorithm */ IntPtr algorithm, /* CFDataRef */ IntPtr plaintext, /* CFErrorRef* */ IntPtr* error);
 
 #if NET
 		[SupportedOSPlatform ("tvos")]
@@ -1219,7 +1219,11 @@ public bool VerifySignature (SecKeyAlgorithm algorithm, NSData signedData, NSDat
 			if (plaintext is null)
 				ObjCRuntime.ThrowHelper.ThrowArgumentNullException (nameof (plaintext));
 
-			var data = SecKeyCreateEncryptedData (Handle, algorithm.GetConstant ().GetHandle (), plaintext.Handle, out var err);
+			IntPtr data;
+			IntPtr err;
+			unsafe {
+				data = SecKeyCreateEncryptedData (Handle, algorithm.GetConstant ().GetHandle (), plaintext.Handle, &err);
+			}
 			error = Runtime.GetNSObject<NSError> (err);
 			return Runtime.GetNSObject<NSData> (data, true);
 		}
diff --git a/tests/cecil-tests/BlittablePInvokes.KnownFailures.cs b/tests/cecil-tests/BlittablePInvokes.KnownFailures.cs
index 1e5259183f19..d9ae9af51ddf 100644
--- a/tests/cecil-tests/BlittablePInvokes.KnownFailures.cs
+++ b/tests/cecil-tests/BlittablePInvokes.KnownFailures.cs
@@ -27,9 +27,6 @@ public partial class BlittablePInvokes {
 			"AVFoundation.AVSampleCursorSyncInfo ObjCRuntime.Messaging::AVSampleCursorSyncInfo_objc_msgSend(System.IntPtr,System.IntPtr)",
 			"AVFoundation.AVSampleCursorSyncInfo ObjCRuntime.Messaging::AVSampleCursorSyncInfo_objc_msgSendSuper_stret(System.IntPtr,System.IntPtr)",
 			"AVFoundation.AVSampleCursorSyncInfo ObjCRuntime.Messaging::AVSampleCursorSyncInfo_objc_msgSendSuper(System.IntPtr,System.IntPtr)",
-			"System.Int32 AudioUnit.AUGraph::NewAUGraph(System.IntPtr&)",
-			"System.IntPtr ObjCRuntime.Selector::GetHandle(System.String)",
-			"System.IntPtr Security.SecKey::SecKeyCreateEncryptedData(System.IntPtr,System.IntPtr,System.IntPtr,System.IntPtr&)",
 			"System.Void ObjCRuntime.Messaging::void_objc_msgSend_GCDualSenseAdaptiveTriggerPositionalAmplitudes_float(System.IntPtr,System.IntPtr,GameController.GCDualSenseAdaptiveTriggerPositionalAmplitudes,System.Single)",
 			"System.Void ObjCRuntime.Messaging::void_objc_msgSend_GCDualSenseAdaptiveTriggerPositionalResistiveStrengths(System.IntPtr,System.IntPtr,GameController.GCDualSenseAdaptiveTriggerPositionalResistiveStrengths)",
 			"System.Void ObjCRuntime.Messaging::void_objc_msgSendSuper_GCDualSenseAdaptiveTriggerPositionalAmplitudes_float(System.IntPtr,System.IntPtr,GameController.GCDualSenseAdaptiveTriggerPositionalAmplitudes,System.Single)",