The *foo{IO} apparently holds sockets, file handles and directory handles but the last two are supposed to have their own namespaces. What whould *X{IO} return following open(X, ...) and opendir(X, ...)?

They share the *X{IO} thingy. *X{IO} will be a single PVIO struct which has some fields used for dirs and some used for filehandles.

What about other reference types: REF? Regexp? LVALUE? Any I've missed?

REF and LVALUE are just types of scalars. The things ref() returns don't have a one-to-one correspondence with typeglob slots. ref \*STDOUT is "GLOB". In 5.9.0 and above, ref \v1.2.3 will be "VSTRING". Regexp is just a package name. qr// is just a reference to a blessed scalar with some magic attached to store the regex. Scalar::Util::reftype(qr/foo/) is just "SCALAR".

NAME and PACKAGE aren't really typeglob slots. If you say *A = *B they don't get aliased. They're just info about the glob itself.