I discovered this from stack traces of toll-free bridged calls.
All CoreFoundation objects have an Objective-C isa pointer. For
toll-free bridged objects, this pointer points to an Objective-C
class
which is a subclass of the corresponding class cluster public class,
like for CFArray the subclass is called __NSCFArray. This Objective-C
class maps calls from Objective-C public API to corresponding
CoreFoundation calls.
All CoreFoundation functions that take toll-free-bridge-able objects
detects if the argument passed in is CoreFoundation object. If Cocoa
objects are used, base on the situation, either the object will be
copied into its CoreFoundation counterpart, or the call will be
mapped
back to Cocoa.
This entangled nature guaranteed that at least all toll-free bridging
private Cocoa classes, their public base classes and NSObject are
inside CoreFoundation binary, or the linker will be seriously
confused.