IMHO, that's a rather stupid interpretation of "dualvar". If the string value equals the stringification of the other value (IV or NV), then it shouldn't be considered a "dualvar". But then, that's what one would expect from a lazy XS function. A Perl version would just do 0+$x eq $x instead.

!1 doesn't need to be implemented as a dualvar. $x=''; {no warnings; 0+$x;} is also enough to get you what is needed for !1 (a string value of '' and a numeric value of 0 w/o a warning). The canonical value for !1 that Perl uses happens to be a real dualvar, though. But "both an empty string and zero" isn't enough to imply "dualvar".

Win32::TieRegistry can use dualvars.

Update: To be clearer, a Perl version of isdual() would be:

sub isdual {
    my( $v ) = @_;
    no warnings;
    return 0
        if  int $v ne $v^'0'    # No IV nor NV in value
        ||  $v eq 0+$v          # Cached string just same as IV/NV
        ||  $v == "$v"          # Cached number just same as 0+PV
    ;
    return 1;
}
[download]

The stringification is cached.

This is a good point. Is this good rule of thumb (bound to be imperfect but close enough)? Anytime an SV with an IV or NV creates a PV representation, that will remain in effect (making it a dualvar) until the container receives a new assignment.

say "!",$x,"!"; doesn't, but "everything else" does.

It is possible (in XS) to put anything in the specific slots:

$ perl -MData::Peek -wC3 \
       -E'my $tv = Data::Peek::triplevar ("\N{GREEK SMALL LETTER PI}", 3, 3.1415);' \
       -e'say for map { $_ // "<undef>" } DDual ($tv)'
π
3
3.1415
<undef>
0

Data::Peek's DDual will return all of those: my ($pv, $iv, $nv, $rv, $hm) = DDual ($var [, $getmagic])