I've never used Safe before, but I thought I'd take a crack.

After I figured out which opcode is for the error (rv2gv, which is in :base_orig), I was getting:

'private value' trapped by operation mask...
[download]

So I found out which one took care of that (padany also in :base_orig):

use strict;
use warnings;

use Safe;
my $box = new Safe;

$box->permit_only(
    ':base_core', 
    'rv2gv',      # ref to glob cast
    'padany'      # private variable
);

my $vi = $box->reval('5',1);
die "$@ " unless (defined $vi);
print "vi=$vi\n";
[download]

Output:

vi=5
[download]

Note that the above can be simplified at the cost of allowing a bunch more opcodes implicitly:

$box->permit_only(':base_core', ':base_orig');
[download]

While doing some searching after figuring out the solution, I came across this: Perl opcode list.