I'm not exactly sure that the "correctness" of a refcount can be determined, as one would have to scan all memory available to Perl for references to the SV in question, and even then the memory pointing to it might not be in use anymore.

What I think should be feasible would be a (tree-structured?) dump of all memory references/SVs, together with their reference count. Then you can liberally sprinkle those calls to the dumper around and see where there is change in the tree when there should be none. On the other hand, the signal to noise ratio here is pretty bad I guess, as pretty much every op allocates or deallocates memory...

I guess that the only other recourse would be valgrind or another memory bounds checker, but I'm not sure if they (can) catch and diagnose double frees via refcount mess-ups. Maybe you can trick Perl into not reusing existing SVs, so you then get a real leak or a real access violation?

I have never done any of this, and the only thing possible without any too deep XS magic seems to me the tree dump, courtesy of Scalar::Util and PadWalker, and the output of that won't necessarily be helpfull...