diff --git a/dlls/oleaut32/tests/usrmarshal.c b/dlls/oleaut32/tests/usrmarshal.c
index 88a073191a8977e742f701d7538a01aa3acc2651..24b382cd3131717f807f45b6b87ca07605e8c51a 100644
--- a/dlls/oleaut32/tests/usrmarshal.c
+++ b/dlls/oleaut32/tests/usrmarshal.c
@@ -769,7 +769,7 @@ static void test_marshal_VARIANT(void)
     BSTR b;
     WCHAR str[] = {'m','a','r','s','h','a','l',' ','t','e','s','t',0};
     SAFEARRAYBOUND sab;
-    LPSAFEARRAY lpsa;
+    LPSAFEARRAY lpsa, lpsa2, lpsa_copy;
     DECIMAL dec, dec2;
     HeapUnknown *heap_unknown;
     DWORD expected;
@@ -1336,6 +1336,64 @@ static void test_marshal_VARIANT(void)
     }
     VARIANT_UserFree(&umcb.Flags, &v2);
     HeapFree(GetProcessHeap(), 0, oldbuffer);
+
+    /*** ARRAY BYREF ***/
+    VariantInit(&v);
+    V_VT(&v) = VT_UI4 | VT_ARRAY | VT_BYREF;
+    V_ARRAYREF(&v) = &lpsa;
+    lpsa->fFeatures |= FADF_STATIC;
+
+    rpcMsg.BufferLength = stubMsg.BufferLength = VARIANT_UserSize(&umcb.Flags, 0, &v);
+    expected = 152;
+    ok(stubMsg.BufferLength == expected || stubMsg.BufferLength == expected + 16, /* win64 */
+       "size %u instead of %u\n", stubMsg.BufferLength, expected);
+    buffer = rpcMsg.Buffer = stubMsg.Buffer = stubMsg.BufferStart = alloc_aligned(stubMsg.BufferLength, &oldbuffer);
+    stubMsg.BufferEnd = stubMsg.Buffer + stubMsg.BufferLength;
+    next = VARIANT_UserMarshal(&umcb.Flags, buffer, &v);
+    ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
+    wirev = (DWORD*)buffer;
+
+    wirev = check_variant_header(wirev, &v, expected);
+    ok(*wirev == 4, "wv[5] %08x\n", *wirev);
+    wirev++;
+    ok(*wirev, "wv[6] %08x\n", *wirev); /* win2k: this is lpsa. winxp: this is (char*)lpsa + 1 */
+    wirev++;
+    check_safearray(wirev, lpsa);
+    lpsa_copy = lpsa2 = SafeArrayCreate(VT_I8, 1, &sab);
+    /* set FADF_STATIC feature to make sure lpsa2->pvData pointer changes if new data buffer is allocated */
+    lpsa2->fFeatures |= FADF_STATIC;
+    mem = lpsa2->pvData;
+    V_VT(&v2) = VT_UI4 | VT_ARRAY | VT_BYREF;
+    V_ARRAYREF(&v2) = &lpsa2;
+    stubMsg.Buffer = buffer;
+    next = VARIANT_UserUnmarshal(&umcb.Flags, buffer, &v2);
+    ok(next == buffer + expected, "got %p expect %p\n", next, buffer + expected);
+    ok(V_VT(&v) == V_VT(&v2), "got vt %d expect %d\n", V_VT(&v), V_VT(&v2));
+    todo_wine ok(lpsa2 == lpsa_copy, "safearray should be reused\n");
+    todo_wine ok(mem == lpsa2->pvData, "safearray data should be reused\n");
+    if(lpsa2 != lpsa_copy)
+    {
+        lpsa_copy->fFeatures &= ~FADF_STATIC;
+        SafeArrayDestroy(lpsa_copy);
+    }
+    ok(SafeArrayGetDim(*V_ARRAYREF(&v)) == SafeArrayGetDim(*V_ARRAYREF(&v2)), "array dims differ\n");
+    SafeArrayGetLBound(*V_ARRAYREF(&v), 1, &bound);
+    SafeArrayGetLBound(*V_ARRAYREF(&v2), 1, &bound2);
+    ok(bound == bound2, "array lbounds differ\n");
+    SafeArrayGetUBound(*V_ARRAYREF(&v), 1, &bound);
+    SafeArrayGetUBound(*V_ARRAYREF(&v2), 1, &bound2);
+    ok(bound == bound2, "array ubounds differ\n");
+    if (pSafeArrayGetVartype)
+    {
+        pSafeArrayGetVartype(*V_ARRAYREF(&v), &vt);
+        pSafeArrayGetVartype(*V_ARRAYREF(&v2), &vt2);
+        ok(vt == vt2, "array vts differ %x %x\n", vt, vt2);
+    }
+    lpsa2->fFeatures &= ~FADF_STATIC;
+    hr = SafeArrayDestroy(*V_ARRAYREF(&v2));
+    ok(hr == S_OK, "got 0x%08x\n", hr);
+    HeapFree(GetProcessHeap(), 0, oldbuffer);
+    lpsa->fFeatures &= ~FADF_STATIC;
     hr = SafeArrayDestroy(lpsa);
     ok(hr == S_OK, "got 0x%08x\n", hr);