... hv = (HV*)NEWSV(502,0); ...

... creates a new hash. We can see that the basic memory needed is 502 bytes

That's not correct: the first parameter to NEWSV is an identifier, used only for malloc debugging. It is the second parameter that provides the size, and a value of zero means "give me a new empty SV - I'll fill it in myself".

It is the following call to sv_upgrade((SV *)hv, SVt_PVHV) that actually turns this into something capable of storing a hash. In particular it allocates the struct xpvhv, defined in hv.h:

struct xpvhv {
    char *  xhv_array;  /* pointer to malloced string */
    STRLEN  xhv_fill;   /* how full xhv_array currently is */
    STRLEN  xhv_max;    /* subscript of last element of xhv_array */
    IV      xhv_keys;   /* how many elements in the array */
    NV      xnv_nv;     /* numeric value, if any */
#define xhv_placeholders xnv_nv
    MAGIC*  xmg_magic;  /* magic for scalar array */
    HV*     xmg_stash;  /* class package */

    I32     xhv_riter;  /* current root of iterator */
    HE      *xhv_eiter; /* current entry of iterator */
    PMOP    *xhv_pmroot;    /* list of pm's for this package */
    char    *xhv_name;  /* name, if a symbol table */
};
[download]

Also the number of buckets does increase in powers of 2, as shown by the example code in demerphq's response. S_more_he() is not relevant to this - it is (I think) fetching a new structure from a malloc arena. The routine you want is S_hsplit() which quite early on does a nice clear:

    register I32 newsize = oldsize * 2;
[download]

Hugo