Not sure what you mean. The native data field is a union, and its interpretation depends on the type of object. When the native function object is created, it

Not sure what you mean. The native data field is a union, and its interpretation depends on the type of object. When the native function object is created, it can be set to an arbitrary integer, and when it's used as intended, it's interpreted as such, as the post says, "generally in a switch statement to further direct the call". When a NetConnection object is created, it's set to a non-arbitrary pointer by the constructor and interpreted as such. The issue is tricking the NetConnection implementation to use the native data of a native function object instead of a real NetConnection object.