You get two difference addresses because you take create references to two different subs, &main::stat and &CORE::stat.

First, you take the address of &main::stat. It's never defined.

$ perl -e'my $sub = \&stat; $sub->("a")'
Undefined subroutine &main::stat called at -e line 1.
[download]

Then, you take the address of &CORE::stat twice. The subs in CORE:: are automatically-generated wrappers for the operators of the same name, so you get a wrapper to the stat operator.

$ perl -e'my $sub = \&CORE::stat; $sub->("a")'
&CORE::stat cannot be called directly at -e line 1.
[download]

Well, it would be if stat had a calling convention that could be duplicated by subroutine prototypes. Instead, it's a wrapper for an error message.