NASM 2.05 based x86 Instruction Reference[ch018]
A.4.2 Emulator call encodings - NTVDM uses C4 C4 (LEA with a register source) followed by one or two callback identifier bytes. - DOSBox uses FE 38 (invalid encoding with /7) followed by a callback identifier word. - dosemu2 uses HLT and dispatches based on the address of the HLT. - 8086tiny uses 0F followed by one identifier byte, currently in the range 00 to 04.