2 months ago
- The 1992 game Comanche: Maximum Overkill used a custom DOS extender with expand-down segments for data to catch null pointer accesses, not unreal mode.
- The game refused to work with EMM emulators and crashed with EMM386 active; it also hung or rebooted without HIMEM.SYS due to a substandard DOS extender.
- The game's protected mode entry code (at 1318:0BB5) did not reload segment registers or perform a far jump as Intel recommended, relying on real-mode CS after switching.
- On 386/486 CPUs, CS remained writable in protected mode because real-mode far jumps changed CS access rights to read/write; Pentium and later CPUs ignored rights in real mode, making CS not writable if it had been reloaded in protected mode since reset.
- The bug caused crashes on some Pentium systems but worked on others, depending on whether the BIOS had reloaded CS in protected mode during POST.
- Even on systems where it worked initially, running any protected-mode software (including Comanche itself) made CS non-writable, causing the game to fail on subsequent launches.
- An updated 1994 CD-ROM release fixed the issues by using DOS/4GW extender and patching the CS-override to ES.
- The problem was documented in a 1992 Intel manual that advised a near jump for prefetch flush, but the 1995 manual explicitly required a far jump; the game's code exploited an undefined behavior that later CPUs changed.