The stack pointer wraparound isn't a compatibility hack. In 16-bit mode PUSH/POP only affect SP (low 16 bits of ESP), just like string instructions only affect SI/DI.<p>An exception only occurs if there is wraparound <i>during</i> a memory access, like a 16 bit word at [FFFFh]. I suspect that EIP never actually becomes 10000h either, but that the prefetch unit sets a special tag bit to indicate that the next instruction is beyond the segment limit, same as it would if it ran off the end of a segment smaller than 64K.<p>Would be easy to check by looking at the register information from that dialog, maybe it also depends on what CPU the code is run on.<p>The 80186 didn't have segment limits (or the #GP exception), but behaved differently from the original in that a word access at [FFFFh] would in fact access the high byte at [10000h], because the increment is done on the 20 bit internal address instead of just the offset.