One of the disadvantages of pass by reference is that the called function may…

In pass-by-reference, the formal parameter is not a private copy of the argument — it is an alias bound directly to the caller's own storage, so any write the called function makes through that parameter is itself a write to the caller's variable. Preventing corruption therefore means the restriction must be enforced on the callee's own view of the parameter — the formal parameter as declared in the function's own signature — not on how the caller happens to have declared its argument.

• passing pointers — a pointer still grants full read-write access to the pointed-to memory, so the function can still corrupt the caller's data through it.

• declaring the actual parameter constant — this only stops the caller itself from reassigning that variable in its own scope; it adds no restriction inside the called function, since pass-by-reference already binds the formal parameter directly to that storage no matter how the caller declared its argument.

• declaring the formal parameter constant — the compiler enforces this on the callee's own view of the parameter, rejecting any assignment to it inside the function body on every call, which is exactly what closes the corruption path.

• "all of the above" — cannot hold, since two of the three listed methods (passing pointers, and constant actual parameters) fail to close the corruption path.

This matches the familiar idiom of a const reference parameter: the const qualifier that matters for protecting the caller's data is the one attached to the function's own parameter declaration, not any qualifier on the caller's variable — confirming that only declaring the formal parameter constant genuinely prevents inadvertent corruption.