Well - the REFCNT of $foo has to be one - it is a copy of the SV * returned from foo(). I am pretty sure that you should add sv_2mortal(out) to your function to avoid leaking the SV.

Michael