I'm no perlguts expert, but I think that if you set up the argument as an SV * and then use sv_setuv() to change its value, it might work better:

long change(unsigned short PID, unsigned short service, SV* returnedHF
+S)
{
  unsigned long hFS;
  long retval;
  retval = DoAttach(PID, service, &hFS);
  sv_setuv(returnedHFS, hFS);
  return retval;
}
[download]

Updated: added example code