When discussing how pointers and their associated data elements are allocated in Microsoft RPC, you have to differentiate between top-level pointers and embedded pointers. It is also useful to refer to the set of all pointers that are not top-level pointers.
Top-level pointers are those that are specified as the names of parameters in function prototypes. Top-level pointers and their referents are always allocated on the server. Embedded pointers are pointers that are embedded in data structures such as arrays, structures, and unions.
When embedded pointers are out-only and null on input, the server application can change their values to non-null. In this case, the client stubs allocate new memory for this data.
If the embedded pointer is not null on the client before the call, the stubs do not allocate memory on the client on return. Instead, the stubs attempt to write the memory associated with the embedded pointer into the existing memory on the client associated with that pointer, overwriting the data already there.
Out-only embedded pointers are discussed in Combining Pointer and Directional Attributes.
The term non-top-level pointers refers to all pointers that are not specified as parameter names in the function prototype, including both embedded pointers and multiple levels of nested pointers.