In any case, NTVDM is a completely separate subsystem
that actually "Boots
up" with its own ROM/BIOS and has its own memory handlers, ivt, idt, gdt,
ldt, etc. It emulates everything it can, but sometimes it can't and it
raises exceptions (which is why many DOS apps won't work). So, by being an
emulator, it has full control over its internal virtual memory. However,
I'm still not convinced that the actual ntvdm.exe process allocates, in
Windows, the first 0x10000 bytes.
NTVDM is a user-mode application. You can put a thread into V86 mode in
your own process using NtSetContextThread()'s EFLAGS value (V86 isn't
masked). NTVDM seems almost identical to a standard Win32 application
except for the slightly different exception handling methods. The "VDD"
documentation in the DDK kinda shows how this mechanism works, letting you
load a DLL into NTVDM's process space.
Melissa