> And someone (I forget off the top of my head) had integrated a CPU
> level emulator with a framework which passed all OS calls to the
> native CPU.  Or something like that.

That sounds a lot like one of my efforts at a VAX simulator: it ran
userland code normally, but when it took a syscall, it handled it by
making the corresponding syscall in the emulator (and, for syscalls for
which it was nontrivial, such as mmap(), arranging for the result to be
visible to the simulated program).

For anyone interested in looking at it, it's in
ftp.rodents.montreal.qc.ca:/mouse/emul/vax/C-userland-emul/ for your
perusal.  I haven't touched it in quite a while, and in some ways it
shows; for example, it is designed for a time when the VAX was still
using a.out executables.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@rodents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B