Could you tell me what address you used when debugging DQ1+2?
Aha, I've found it!
But here's the process through which I discovered it.
I used the cheat finder in bsnes-plus after each fight and found the only address which had the same number as my XP each time: $7E0C11. As you see, it has $7E at the start, but as I've just discovered, it seems like every bank is identical ($10C11, $20C11 etc, all the same). So instead of adding $7E, I just set a breakpoint for $C11. And what do you know? $BA889 has an instruction: "lda $0C11,x". So the instruction itself refers to $C11, not $7E0C11, which would explain why it didn't break for me.
Anyway, this happens at the end of a fight, and it adds your current XP to that for the fight (stored at $ED8). So I'll just have a go at making a new routine to double that amount...
EDIT: And it's done. http://s346165667.websitehome.co.uk/psyktrans/dragonquest12-2xp.zip
It was really quite easy once I figured out how the memory mapping worked. I'm amazed at how similar the SNES's 65816 is to the 6502. It was just like hacking the NES, but with a ton more space to play with.
Well, with that out of the way, I can get going on all those other SNES RPGs that need to be done! And I'm sure there are a lot. Incidentally, I think I'm at a point when I should be officially releasing these patches, don't you guys think so?
EDIT2: I should point out that this patch only applies to Dragon Quest 1, not 2. I foolishly forgot that there are two games on the cart.
EDIT3: Never mind! Turns out the game uses the same routine for both DQ1 and 2, so my patch works for both games!