Steps:

1. Allocate an Uint8Array with the same size as the function receives (you can check the size_t argument)
2. Copy the original buffer to our newly allocated one.
3. Perform the required operations (directly in the ArrayBuffer or convert it as a string back-and-forth).
4. Get a pointer to the first element of our newly allocated buffer by calling .unwrap().

const sslWritePtr = Module.getExportByName(null, "ssl_write");

function str2ab(str) {
  let buf = new ArrayBuffer(str.length);
  let bufView = new Uint8Array(buf);
  for (var i=0, strLen=str.length; i < strLen; i++) {
    bufView[i] = str.charCodeAt(i);
  }
  return buf;
}

Interceptor.attach(sslWritePtr, {
        onEnter: function (args) {
          // Get the buffer size by checking the third argument. 
          const buffer_size = args[2].toInt32() + 1;
          // Read the contents of the buffer and get an ArrayBuffer.
          let buffer = args[1].readByteArray(buffer_size);
          // Convert it to a string object.
          let buffer_string = String.fromCharCode.apply(null, new Uint8Array(buffer));
          // Replace the contents.
          buffer_string = buffer_string.replace("AAAAAA", "BBBBBB");

          // Convert `buffer_string` back to an ArrayBuffer. 
          // .unwrap() returns a pointer to the first element of the Uint8Array
          args[1] = str2ab(str).unwrap(); // Assign the pointer of our new Uint8Array.
        },
});

This link might be useful to understand better how to operate in this situation: https://learnfrida.info/intermediate_usage/#operating-with-arraybuffers