Tensor products in the definition of a Riemannian metric In the book Introduction to Smooth Manifolds the following is stated

In any smooth local coordinates $(x^i)$ on a smooth manifold $M$, a Riemannian metric $g$ can be written as $$g = g_{ij} dx^i \otimes dx^j$$

Now I basically just want to understand rigorously how we can take the tensor product of $dx^i$ and $dx^j$. But I ran into a few problems as shown below

What the above quote from the book means rigorously is that given a coordinate chart $(U, \varphi)$ in the atlas of $M$, where $U$ is an open subset of $M$ and $\varphi : U \to \mathbb{R}^n$ is a homeomorphism from $U$ to an open subset $\varphi[U] \subseteq \mathbb{R}^n$. For $p \in U$ we have $\varphi(p) = (x^1(p), \dots, x^n(p))$ where the $x^i$ are the component functions of $\varphi$. (i.e. $x^i : U \to \mathbb{R}$). 
By definition of the differential (and after a little bit of work) it follows that $$dx^i : TU \to T\mathbb{R}$$ where $TU$ is the tangent bundle on the open set $U$.
It's stated in Introduction to Smooth Manifolds that $dx^i$ (being the differential of a smooth function) is also a smooth covector field, which means that $dx^i$ is a smooth section of the cotangent bundle, which I assume must be the vector bundle $(T^*U, \pi, U)$ where $\pi$ is the natural projection map $\pi :T^*U \to U$ defined by $\pi(p, \omega) = p$. That means that $dx^i$ is a map from $U$ to $T^*U$ $$dx^i : U \to T^*U$$
But these seem to be two contradictory things we've arrived at. I don't see how $dx^i$ can be a map from $TU \to T\mathbb{R}$ and simultaneously be a map from $U \to T^*U$. 

What is the error in my understanding above? (Note that I've used two different definitions of the differential of a smooth map above, both covered in the book and both which the author states are essentially the same object)
Now I think what's actually going on is that $dx^i$ and $dx^j$ are smooth covector fields on $U$ and we take some sort of tensor product on their cotangent bundles (though I'm not really sure how this is done since the cotangent bundle being a vector bundle doesn't come equipped with a (global) vector space structure, so I'm assuming we do it pointwise).
 A: I‘ll try to explain this using general covectorfields on a manifold $N$ (observe that if $U\subset M$ is open, $U$ itself can be seen as manifold).
A covectorfield $\omega$ is a smooth map from $N$ to $T^*N,$ that is a smooth (in some sense not really important for the point I want to get across) map that associates to each $p\in N$ a linear map $\omega_p:T_pN\to \mathbb{R}.$
So in this case we see $\omega$ as a map $p\mapsto \omega_p$ and each $\omega_p$ eats tangent vectors at $p$ (and spits them out „in a linear way“).
Now we can also see this differently:
Recall that $TG=\{(p,v)| p\in N, v \in T_pN\}.$ It‘s also possible to think of $\omega$ as a map $\tilde{\omega}:TN\to\mathbb{R}$ which sends $(p,v)\in T^*N$ to
\begin{equation}
\tilde{\omega}(p,v)=\omega_p(v),
\end{equation}i.e. each „point-vector-pair“ gets maped to a real number, such that for fixed point the map is linear.
To put it really concisely: We have a bijection between these two ways of thinkinhg by
\begin{equation}
\omega_p \leftrightarrow \tilde{\omega}(p,\cdot ).
\end{equation}
This might only look like a switch of notation, but it represents two ways of thinking about a covectorfield.
