The emulation code for the instructions that cannot be executed in vm86 mode directly (iretd, pushf and a few others) accesses user space memory without an exception handler. This can cause a kernel oops if the stack pointer points to non-present or read-only memory areas. The attached patch adds these handlers, but I can't test them properly. Under 2.5.2-pre1, dosemu still runs. The patch applies to both 2.4.17 and 2.2.20. Please test it. -- Manfred