# http://rt.perl.org/rt3/Public/Bug/Display.html?id=56908
# http://perl5.git.perl.org/perl.git/commitdiff/b17f5ab768c4daa8faac6c85c0c20d3895f406e1?hp=7ee5fac837a8a4ebf1956da1b1d252aa82fe506d
diff --git a/hv.c b/hv.c
index 3d4d3af..24d9150 100644
--- hv.c
+++ hv.c
@@ -1985,6 +1985,7 @@ Perl_hv_kill_backrefs(pTHX_ HV *hv) {
     if (av) {
 	HvAUX(hv)->xhv_backreferences = 0;
 	Perl_sv_kill_backrefs(aTHX_ (SV*) hv, av);
+	SvREFCNT_dec(av);
     }
 }
 
diff --git a/sv.c b/sv.c
index 04d6e43..4792ad1 100644
--- sv.c
+++ sv.c
@@ -10784,10 +10784,11 @@ Perl_sv_dup(pTHX_ const SV *const sstr, CLONE_PARAMS *const param)
 			daux->xhv_eiter = saux->xhv_eiter
 			    ? he_dup(saux->xhv_eiter,
 					(bool)!!HvSHAREKEYS(sstr), param) : 0;
+			/* backref array needs refcnt=2; see sv_add_backref */
 			daux->xhv_backreferences =
 			    saux->xhv_backreferences
 				? (AV*) SvREFCNT_inc(
-					sv_dup((SV*)saux->xhv_backreferences, param))
+					sv_dup_inc((SV*)saux->xhv_backreferences, param))
 				: 0;
 
                         daux->xhv_mro_meta = saux->xhv_mro_meta