It never used to, but obviously has for some time--at least since 5.8.6

At least since 5.6.0.

From what I can tell, 'get' magic works by storing the value from the magic handler into the SV, allowing the code that follows to ignore magic. (mg_get: Do magic after a value is retrieved from the SV.) That would explain the copy.

Similarly, 'set' magic works by passing the value in the SV to the magic handler, allowing the code that preceeds to ignore magic. (mg_set: Do magic after a value is assigned to the SV.) That would also create a copy.

If my understanding is correct, that means the problem isn't related to lvalue substr but with magic in general.