That example code leaks an SV.

No, it does not. As mentioned, running this within a while(1) loop, even for several minutes (ie, millions and millions of iterations) produces 0 growth. That is unequivocally no leak.

my $count = 0;
while (1) {
    my $test = eg();

    print $count++."\n";
    reportHash($test);
    reportScalar($test->{x});

    $test = undef;
}
[download]

Try this yourself. If even a single byte were leaking per iteration, this would be pretty obvious pretty quickly in a monitor.

I believe the problem you perceive is circumvented by the use of _noinc -- the value returned does not increment the reference count of the SV. Otherwise, it would be impossible to return an RV without a leak.

I will look at PL_sv_count tho.