>Maybe with cache poisoning? If the instruction after STOREALL could be fetched from cache and regular ring 0 could poison that cache, code execution in ICE mod

>Maybe with cache poisoning? If the instruction after STOREALL could be fetched from cache and regular ring 0 could poison that cache, code execution in ICE mode might be possible. The 286 had no internal cache (in the sense of CPUs today). It did have a queue of prefetched instruction bytes, as well as another queue of up to 3 decoded instructions. But that gets flushed by STOREALL, since it effectively returns the CPU to the same state as after a reset, only with the ICE mode flip-flop set. (Normal breakpoints, or any control transfer at all, also have to clear the queues, else the CPU would first execute whatever it had prefetched before continuing with code from the new location!) And yes, in my experiments with this I did try to stuff something in the prefetch queue anyway, as well as setting the IDT limit to zero and enabling the trap flag in the hope that it would cause a triple-fault while in ICE mode. No such luck. What might be possible is some external hardware that pushes opcode bytes onto the bus with the right timing. I'm not enough of a hardware person to design something like this, and don't think the DMA controller could be (ab)used for that purpose.