I'd think that this would be tricky. The problem is that while you might track what Perl is doing (be careful to not follow weak references!), various XS modules are going to have pointers into Perl data structures that come from non-Perl data structures. How do you find and account for those?

I wouldn't bother. The tool can simply report those as refcount inconsitancies. The tool could show all the paths if found to each SV together with the reference count on the SV. If there are legitmate refernce paths through non-perlish structures then these should show up.

That said, when I write XS modules I avoid this problem. If I need my objects to contain hidden internal stuff that holds references to SVs I do so by hanging Perl structures off of the MAGIC list. In this way my private stuff is hidden from the Perl programmer but could still be traversed by the proposed tool.