You increment the reference count when you take hold of an SV/AV/etc. (This is already done for you by the new* functions.)

You decrement the reference count (or mortalize) when you relinquish your hold of an SV/AV/etc.

Should I manually unref them

av_push says it "takes ownership of one reference count". This means it assumes you are relinquishing your hold on the scalar, and it will adjust the reference count accordingly. There's nothing else to be done (unless you store a copy of the SV locally, in which case you'd want to increment the reference count).

or they are automatically destroyed on XS function return?

That would be bad, since the array still references them. They are destroyed when their reference count becomes zero.

Does the use of mPUSHs(AV) correct?

Subs can only return scalars, so no. You need to place a reference to the array on the stack.

mPUSHs(newRV_noinc(MUTABLE_SV(av)));
[download]

Like with av_push, newRV_noinc takes ownership of a reference count.