So here's a guess at what may be going on -- I downloaded a DOS/real mode
PNP BIOS query tool (see http://www.ddj.com/ftp/1995/1995.09/pnpdemo.zip)
and traced through the call made through the PNPBIOS, and at some point, 
the BIOS goes frobbing through memory at 0040:0010 (which a google search
tells me holds the BIOS-detected hardware list).

I bet this causes a 16-bit protected-mode fault, which I'm pretty sure
we're not set up to handle.

I'll see if I can hack something up to verify that this is indeed the 
cause, but I'm not wizardly enough to come up with a way of handling
faults in 16-bit PM BIOS calls. 8-)

--rafal

----
Rafal Boni                                                  rafal@mediaone.net