MS-DOS 6.22 Memory Above 16 MB on 80486 CPUs

MS-DOS 6.22 is a 16-bit real-mode operating system fundamentally restricted to 1 MB of native address space, yet it successfully manages memory beyond 16 MB on 32-bit Intel 80486 processors. This is achieved through the architectural capabilities of the 80486's 32-bit address bus combined with MS-DOS's Extended Memory Specification (XMS 3.0) driver, HIMEM.SYS, and third-party DOS extenders that switch the CPU into protected mode.

The 80486 Hardware Advantage

The Intel 80486 processor features a full 32-bit physical address bus, allowing it to address up to 4 GB (\(2^{32}\) bytes) of RAM. This removed the physical bottleneck found in earlier chips like the 80286 and 80386SX, which had 24-bit address buses capped at 16 MB. However, when booted, the 80486 initializes in real mode, emulating an 8086 processor limited to 1 MB. To access the memory above 16 MB, the processor must be directed to utilize its 32-bit protected mode capabilities.

The Role of HIMEM.SYS and XMS 3.0

MS-DOS 6.22 includes HIMEM.SYS version 3.x, which implements the eXtended Memory Specification (XMS) version 3.0.

  • Breaking the 16 MB/64 MB Barrier: Previous XMS versions (such as XMS 2.0) used 16-bit integer handles to measure memory in kilobytes, creating hard limits at 64 MB (and practical BIOS-related barriers at 16 MB). XMS 3.0 introduced 32-bit handle functions (functions 88h through 8Fh) that track memory allocations in 32-bit values.
  • Super Extended Memory: Under XMS 3.0, memory above 64 MB—and fully through the multi-gigabyte range supported by the 80486—is classified as "Super Extended Memory." HIMEM.SYS queries system BIOS routines (specifically INT 15h extensions such as AX=E801h or AH=88h) to detect available memory blocks beyond 16 MB and reserves them for application use.

Data Transfer via Block Moves

Because MS-DOS 6.22 cannot execute native program code in real mode above the 1 MB mark, HIMEM.SYS treats memory above 16 MB as a high-capacity storage buffer.

When a standard real-mode application needs to read or write to this memory:

  1. The application populates an ExtMemoryMove structure specifying the source and destination addresses.
  2. It calls XMS Function 0Bh (Move Extended Memory Block).
  3. The driver temporarily switches the 80486 into protected mode or unreal mode, copies the designated block between extended memory (above 16 MB) and conventional memory (below 1 MB), and switches the CPU back to real mode before returning control to the program.

Direct Access via 32-bit DOS Extenders

Software requiring direct execution rather than simple data copying—such as compilers, CAD applications, and 3D games—relies on DOS extenders (such as DOS/4GW, Phar Lap, or Causeway) combined with the DOS Protected Mode Interface (DPMI):

  1. Initialization: The extender communicates with HIMEM.SYS via XMS 3.0 to reserve raw physical memory blocks above 16 MB.
  2. Mode Switching: The extender configures the 80486’s Global Descriptor Table (GDT) and switches the processor permanently into 32-bit protected mode.
  3. Flat Addressing: In protected mode, the 80486 views memory as a continuous 4 GB linear address space. The application can natively read, write, and execute code above 16 MB using 32-bit registers (such as EAX and EBX).
  4. DOS API Translation: Whenever the application requires MS-DOS services (such as file I/O), the extender intercepts the interrupt, copies any required buffers below the 1 MB threshold, switches back to real mode to let MS-DOS 6.22 process the request, and returns to protected mode.