The refcount of $hash is 2 because $retval and $hash both reference it.

The method you are looking for could be Scalar::Util::weaken.

But that's unlikely to help if your third party module has cyclic references in internal data structures. Try Devel::Leak or Devel::Leak::Object to find the bad guy.