John,

Having played with VM86 mode (and having given up in disgust)..  I
note you commented out the following:

/*    tf->tf_es     = vmcp->sc_es;*/
/*    tf->tf_ds     = vmcp->sc_ds;*/

[I bumped into this "problem" myself when exploring VM86 mode..]

VM86 mode won't be useful until you can put arbitrary values into the
vm86 ds and es regs.  

Just to stress-test the system, try loading zeros into ds and es once
you're in VM86 mode and see if the system will still keep running..

					- Bill