It looks like LoweredDynamicOperationFactory.GetReceiverRefKind hasn't been adjusted for ref returns

[AlekseyTs]

It looks like ref returning properties and methods are not getting special treatment:

        // If we have a struct calling object, then we need to pass it by ref, provided
        // that it was an Lvalue. For instance,
        //     Struct s = ...; dynamic d = ...;
        //     s.M(d); // becomes Site(ref s, d)
        // however
        //     dynamic d = ...;
        //     GetS().M(d); // becomes Site(GetS(), d) without ref on the target obj arg
        internal static RefKind GetReceiverRefKind(BoundExpression loweredReceiver)
        {
            Debug.Assert(loweredReceiver.Type is { });
            if (!loweredReceiver.Type.IsValueType)
            {
                return RefKind.None;
            }

            switch (loweredReceiver.Kind)
            {
                case BoundKind.Parameter:
                    Debug.Assert(!LocalRewriter.IsCapturedPrimaryConstructorParameter(loweredReceiver));
                    goto case BoundKind.Local;

                case BoundKind.Local:
                case BoundKind.ArrayAccess:
                case BoundKind.ThisReference:
                case BoundKind.PointerIndirectionOperator:
                case BoundKind.PointerElementAccess:
                case BoundKind.RefValueOperator:
                    return RefKind.Ref;

                case BoundKind.BaseReference:
                // base dynamic dispatch is not supported, an error has already been reported
                case BoundKind.TypeExpression:
                    throw ExceptionUtilities.UnexpectedValue(loweredReceiver.Kind);
            }

            return RefKind.None;
        }

[jcouv]

Assigned to @cston for investigation and triage during C# 12 timeframe