ref returns LVALUE for a reference to a PVLV, a scalar subtype. You can read about it a bit here. It's basically a scalar that's going to have magic associated with it, and it has a few extra fields for storage the magic can use.

Magic, among other things, allows one to attach a getter and fetcher to a variable.

You might think that

substr($_, 3, 2) = 'foo';
[download]

gets converted to

substr($_, 3, 2, 'foo');
[download]

by the compiler, but it isn't. substr is truly called as is. This allows the following to work

my $ref = \substr($_, 3, 2);
$$ref = 'foo';
[download]

That means substr must return a magical scalar.

There are more than one type of scalar. Some can hold an integer, some can hold a string, some can hold both. Perl automatically upgrades a scalar when necessary.

Magical scalars require extra fields to store information about what magic is attached to the scalar. The most basic scalar subtype capable of being magical is the PVMG, but there is also PVLV. The PVLV is a PVMG with four extra fields: TYPE, TARGOFF, TARGLEN and TARG.

A instance of substr in an lvalue context returns a PVLV. It uses TARG, TARGOFF and TARGLEN to store the three arguments passed to substr^[1].

>perl -MDevel::Peek -e"$_ = 'abcdef'; my $ref = \substr($_, 3, 2); Dum
+p($$ref);"
SV = PVLV(0x4d3d24) at 0x2cb29c      <--- PVLV
  REFCNT = 1
  FLAGS = (TEMP,GMG,SMG)             <--- "get" magic and "set" magic
  IV = 0
  NV = 0
  PV = 0
  MAGIC = 0x49f09c
    MG_VIRTUAL = &PL_vtbl_substr     <--- Function pointers for magic
    MG_TYPE = PERL_MAGIC_substr(x)   <--- x = substr magic
  TYPE = x                           <--- x = substr magic
  TARGOFF = 3           <--- For "x", start offset of substring
  TARGLEN = 2           <--- For "x", length of substring
  TARG = 0x4a8414       <--- For "x", addr of associated scalar ($_)
  FLAGS = 0
  SV = PV(0x2c8a6c) at 0x4a8414  <--- Dump of associated scalar ($_)
    REFCNT = 2
    FLAGS = (POK,pPOK)
    PV = 0x2cab94 "abcdef"\0
    CUR = 6
    LEN = 12
[download]

When you try to fetch from $$ref, the associated get magic first does something like $$ref = substr($$TARG, $TARGOFF, $TARGLEN);.

After you assign to $$ref, the associated "set" magic effectively does substr($$TARG, $TARGOFF, $TARGLEN, $$ref);.

Notes

1. Missing and negative arguments are resolved before being assigned.