Debugging Issue & Marshal.PtrToStructure() question

[kiwids0220]

When debugging the SharpDPAPI with below config/flags, I had an questions on why the pointer is not showing in the correct address as the debugger says.

Then I realized it might be due to misdecleared variables within the Struct,

        public struct LSA_UNICODE_STRING : IDisposable
        {
            public ushort Length;
            public ushort MaximumLength;
            public ushort certLen;
            public IntPtr buffer;

            public LSA_UNICODE_STRING(string s)
            {
                Length = (ushort)(s.Length * 2);
                MaximumLength = (ushort)(Length + 2);
                certLen = (ushort)(Length + 2);
                buffer = Marshal.StringToHGlobalUni(s);
            }

            public void Dispose()
            {
                Marshal.FreeHGlobal(buffer);
                buffer = IntPtr.Zero;
            }

            public override string ToString()
            {
                return Marshal.PtrToStringUni(buffer);
            }
        }

which then I saw the ref to mimikatz header and added another declearation for certLen. And that matched with length appearing apperaing 3 times in the memory shown here and stepping through.

But previously, it also worked just fine without the certLen. So I was wondering Does Marshal.PtrToStructure() in Interop.LSA_UNICODE_STRING lusSecretData = (Interop.LSA_UNICODE_STRING)Marshal.PtrToStructure(PrivateData, typeof(Interop.LSA_UNICODE_STRING)); just magically finds the IntPtr in the memory of PrivateData which is really after the CertLen + 2 null bytes?

Sorry if im being confusing here.