Int 67 Fn 3F  U - QEMM-386 V4.23+ - Installation Check  (Cont.)

           calls AX=1307h
   AX = 130Eh ??? (modifies CRT controller setup)
       ???

       Return: CF clear
   AX = 130Fh reset ???

       Return: CF clear
   AX = 1310h ???
       ???

       Return: CF clear

       Note:   disables certain interrupts at the two 8259 PICs during
             execution (see AX=130Ch) and runs inside a QEMM
             critical section
           also calls AX=130Dh
   AX = 1311h set ???
       BL = ???

       Return: CF clear
   AX = 1312h (v6.02) NOP???

       Note:   called by DV 2.42, but appears to be a NOP in QEMM 6.02
   AX = 1400h ???
       ES:DI -> ??? data structure (at least 24 bytes)
       BL = ???

       Return: AX = ???
       Data structure
       Offset  Size    Description
        00h    WORD    ???
        02h    DWORD   far pointer to ???
        06h    DWORD   far pointer to ??? pointer array (see below)
        0Ah    DWORD   far pointer to ???
        0Eh    DWORD   ???
        12h    WORD    segment of ???
        14h    DWORD   far pointer to ???
       Pointer array
       Offset  Size    Description
        00h    WORD    number of pointers to follow
        02h  N DWORDs  far pointers to ???

       Note: QEMM converts the pointers into linear addresses in place
   AX = 1401h ???

       Return: CF clear
           ???
   AX = 1402h ???
       BL = function
           00h NOP
           01h ???
           02h ???
           other ???
       ES:DI -> ???

       Return: CF clear
           ???
       Data structure
       Offset  Size    Description
        00h    WORD    segment of ??? (X, word at X:0136h set to X)
        02h    WORD    segment of ??? (word at X:0124h set to this)
        04h    WORD    number of paragraphs of ???
        06h  3 WORDs   ??? (copied to X:0000h)
        0Ch    WORD    ???
   AX = 1403h add ??? to list and ??? (execute func 1406h)
       ES:DI -> ??? structure added to end of ??? list
           (at least 31 bytes, DWORD at offset 06h used for
            storing pointer to next struc, WORD at offset 00h
            seems to be a key or index)

       Return: CF clear
   AX = 1404h NOP
   AX = 1405h remove ??? from ??? list
       BX = key???

       Return: CF clear
   AX = 1406h ???
       ???

       Return: CF clear
           ???
   AX = 1407h ???
       ???

       Return: CF clear
           ???
   AX = 1408h ???
       ???

       Return: CF clear
           ???
   AX = 1409h ???
       ???

       Return: CF clear
           ???
   AX = 140Ah ???
       BX = ???

       Return: CF clear
           ???
   AX = 140Bh ???
       BX = ???

       Return: CF clear
           SI = segment of 256-byte buffer???
   AH = 15h ???
       ES:BX -> ??? or 0000h:0000h

       Return: CF clear
     ---QEMM v5.00+ ---
   AX = 1600h get memory access status
       ES:DI -> 256-byte buffer

       Return: ES:DI buffer filled

       Note:   each byte of the buffer indicates the status of a 4K
             page (bit 0 set if read, bit 1 set if written)
   AX = 1601h set memory access status
       ES:DI -> 256-byte buffer containing access statuses (see above)
   AH = 17h get memory usage statistics
       ES:DI -> 81-byte buffer for memory statistics (see below)

       Return: CF clear
     ---QEMM v5.11+ ---
   AH = 18h check whether conventional memory mapped into address range
       ES:BX = starting address
       CX = number of 4K pages

       Return: CF clear
           AL = 00h one or more pages is remapped
                01h all pages in range are conventional memory
               (physical address == virtual address)
   AH = 19h NOP

       Return: CF set
   AH = 1Ah I/O port access
       AL = subfunction
           00h get byte from I/O port

           Return: BL = port value
           01h send byte to I/O port
           BL = value to send
           02h send byte to I/O port, get byte from following port
           BH = value to send

           Return: BL = value read
           03h send bytes to two consecutive I/O ports
           BH = value for first I/O port (DX)
           BL = value for second I/O port (DX+1)
       DX = port number

       Return: CF clear
   AH = 1Bh MS Windows 3.x support
       AL = subfunction
           00h get EMM Import Structure address
           ES:DI -> buffer for EMM import data structure

           Return: CF set on error
               CF clear if successful
           EMM Import data structure:
           Offset  Size    Description
            00h    DWORD   physical address of EMM import struct
            04h    BYTE    major version (v6.00 sets to 01h)
            05h    BYTE    minor version (v6.00 sets to 00h/0Bh)

           See Also: INT 21/AX=4402h/SF=01h
           01h ???

           Return: CF set on error
               CF clear if successful
           02h ???

           Return: CF set on error
               CF clear if successful
           03h MS Windows initializing
           CX = segment from which Windows init broadcast made???
           DL = Windows startup flags???
           DI = Windows version number (major in upper byte)

           Return: ???

           See Also: INT 2F/AX=1605h
           04h MS Windows terminating

           Return: CF clear
           05h determine whether program is driver???
           DS:DX -> ASCIZ filename

           Return: CF clear
               AL = 01h if string ends in ".DRV"
                  = FFh if string ends in "GDI.EXE"
                  = 00h otherwise
           06h ???
           CX = length of data pointed at by DS:DX
           DS:DX -> ???

           Return: CF clear
           07h BUG: QEMM 6.00-7.01 accept this and branch randomly

           else Return: CF set
   AH = 1Ch protected-mode hardware interrupt handlers ???
       AL = subfunction
           00h restore??? IRQ0-7 handlers
           01h set??? IRQ0-7 handlers
           ES:DI -> 8 DWORDs containing ???
           02h restore??? IRQ8-15 handlers
           03h set??? IRQ8-15 handlers
           ES:DI -> 8 DWORDs containing ???
       BUG: although the jump table only contains four entries,
           QEMM 6.00 will attempt to use it for any value of
           AL between 00h and 2Ah, thus branching unpredictably
           for AL=04h-2Ah; QEMM v7.01 behaves similarly for
           AL=04h-1Bh
     ---QEMM v6.00+ ---
   AH = 1Dh Stealth interrupts
       AL = subfunction
           00h switch to pre-Stealth interrupt vector table

           Note:   also switches VGA Save table pointer
                 (0040h:00A8h) and overwrites the vectors
                 currently assigned for use by the two
                 interrupt controllers (see INT 67/AX=DE0Ah)
                 with the vectors for INT 08-0F and 70-77 (to
                 avoid crashing the system).
           01h restore user interrupt vector table

           Notes:  interrupts should be disabled around the
                 AX=1D00h and AX=1D01h calls because QEMM does
                 not modify the memory maps to map in ROM, so
                 an interrupt could be disastrous
               clears any pending IRQ7 at end of function
           else

           Return: CF set

       Note:   functions 1Dxxh are not supported by QEMM v7.01, and
             always return CF set
   AH = 1Eh Stealth information (documented)
       AL = subfunction
           00h "QEMM_GET_INFO" get Stealth configuration

           Return: BL = flags (documented as "reserved")
                   bit 0: conventional memory sorted
                   bit 1: conventional memory filled
                   bit 2: ???
                   bit 3: ???
                   bit 4: expanded memory is in use
                   bit 5: ???
               BH = reserved (always 00h for v6.00)
               CL = stealth type (00h none,46h Frame,4Dh Map)
               CH = suspend/resume interrupt (00h none)
               DX = reserved (always 0000h for v6.00)
               SI = reserved (always 0000h for v6.00)
               DI = reserved (always 0000h for v6.00)
           01h "QEMM_GET_STEALTH_COUNT" get number of Stealth'ed ROMs

           Return: CF clear
               BX = number of Stealth'ed ROMs
           02h "QEMM_GET_STEALTH_LIST" get Stealth'ed ROM info
           ES:DI -> buffer for Stealth ROM info (see below)

           Return: CF clear
               BX = number of Stealth'ed ROMs
               ES:DI buffer filled
           else

           Return: CF set
   AH = 1Fh page table manipulation (documented)
       AL = subfunction
           00h "QEMM_GET_PTE" get page table entry
           CX = page number

           Return: EDX = page table entry
               CF clear
           01h "QEMM_SET_PTE" set page table entry
           CX = page number
           EDX = new page table entry

           Return: CF clear

           See Also: function 1008h
           else

           Return: CF set
   AH = 20h asynchronous disk access support (documented)
       AL = subfunction
           00h "QEMM_GET_VHI_INFO" get VirtualHDIRQ information

           Return: CF clear
               BL = flags
                   bit 7: VirtualHDIRQ setting respected
                    (set if Stealth active)
                   bits 6-1 reserved
                   bit 0: VirtualHDIRQ currently enabled
                   (INT 15/AH=90h suppressed when enabled)
           01h "QEMM_SET_VHI_FINO" set VirtualHDIRQ state
           BL bit 0 = new VirtualHDIRQ state

           Return: CF clear
               BL = old VHI setting (bits 0 and 7, see above)
           else

           Return: CF set
   AH = 21h Stealth support (documented)
       AL = subfunction
           00h "QEMM_COPY_STEALTH_ROMS" copy data from Stealthed addr
           DS:SI -> start address of hidden memory to copy
           ES:DI -> buffer for copied data
           ECX = number of bytes to copy

           Return: CF clear if successful
               CF set on error (DS:SI < C000h:0000h or
                        DS:SI + ECX > 1M)
           else

           Return: CF set
   ---QEMM v6.03+ ---
   AH = 22h DESQview/X support
       AL = subfunction
           00h get ???

           Return: CF clear
               ES:DI -> ???
           01h set ???
           ES:DI -> ??? or 0000h:0000h

           Return: CF clear if successful
               CF set on error
   ---QEMM v6.04+ ---
   AH = 23h ???
       AL = subfunction
           00h get ???
           BX = which ??? to get (must be 0000h for v6.04)

           Return: CF clear if successful
                   ES:DI -> ???
               CF set on error
           01h set ???
           BX = which ??? to set (must be 0000h for v6.04)
           ES:DI -> ???

           Return: CF clear if successful
               CF set on error
           02h clear specified ???
           BX = which ??? to clear (must be 0000h for v6.04)

           Return: CF clear if successful
               CF set on error
           FFh clear all ???
           else

           Return: CF set
   ---QEMM v7.01 only---
   AH = 24h ST-DBL support
       AL = subfunction
           00h set ???
           EDX -> information table
               (EDX = segment SHL 16 + offset)
           01h ???
   other

       Return: CF set

Format of QEMM 6.0 memory statistics:
Offset Size    Description
 00h   BYTE    01h if Shadow RAM found, 00h otherwise
 01h   DWORD   initial conventional memory in bytes
 05h   DWORD   initial extended memory in bytes
 09h   DWORD   initial expanded memory in bytes
 0Dh   DWORD   initial "top" or "shadow" memory in bytes
 11h   DWORD   Unavailable conventional memory in bytes

.NG limit reached, continued in next section...