Moff, I confirm that on my side the unreleased reference also comes from _UIFloatingTabBarItemView.
Richard, as to why my hack didn't work for Moff, it is definitely related to the version of iPadOS.
iPadOS 18.7.1 (physical iPad): there is an additional unreleased reference to the tab bar view controller from a _UIFloatingTabBarItemCell. However my hack works.
iPadOS 26.2 (simulator): there's only one reference from a _UIFloatingTabBarItemView, exactly as you described (same memory graph as yours). And indeed my hack doesn't work
I hope the issue will be fixed for both versions of iPadOS. Please keep us posted here.
Topic:
UI Frameworks
SubTopic:
UIKit