However, one or more of the message variants has pointer members.

So a user system call can insert the address of a user struct into the message being passed to the process manager and the process manager can insert this same pointer into a message sent to the system task.

But this pointer value is a virtual address in the user's address space, not a physical address.

Similarly, the address of the collected data is a virtual address in the sysyem task's address space.