The flag is no problem, but the arguments won't be passed into the d3d9 device.
d3d9_device holds a pointer to the d3d object. Again, this is exactly the way things work for d3d9ex. You should be able to follow *exactly* the same model, and refer to that when confused.
Where would you store D3D9ON12_ARGS *override_list and UINT override_entries? UINT sdk_version doesn't seem to be used anyway so that's not a problem.
In the d3d9 object.
I'm also inclined to recommend a better name than "override_list". Yes, the Microsoft headers use it, but the Microsoft headers make a lot of poor choices.
What would you do in Direct3DCreate9On12?
You can implement a separate refcount without needing a separate object (just use a separate refcount field), although it's not clear we need to care.
This doesn't make sense to me. Are there examples of objects with more than one refcount?
Yes, but I don't think it's worth implementing unless we find an application that needs it.
D3D9on12 is only created if the right arguments are passed to Direct3DCreate9On12. And it can be released independently of IDirect3DDevice9 so it should have its own refcount. Also, wouldn't it be better from a memory management perspective to handle it as a separate object?
QueryInterface() is supposed to be symmetric. That means that neither "object" can be destroyed until the other is, which means that they're really just one object. From a memory management perspective, that implies one allocation.