I've been staring at this problem the past few hours without making any progress. But I feel like I'm overlooking something obvious..

Using Adam's comhelpers, I've made a JSON plugin for LogParser. However after running for a bit it'll crash with signs of memory corruption.

My guess was the GC was collecting things still in use, and disabling the GC does indeed 'fix' the problem. Looking through comhelpers, the code doesn't add a GC root for a created object before handing it off to the C side. I've added root adding and removing, expecting that to fix the problem. However it didn't help.

The DLL uses the helper functions like dll_process_attach in DllMain, so druntime is initialized.

What would be a good way to figure out why the GC decides to collect objects I'm still holding on to?

You can enable logging in GC and see what's allocated and collected.