Does (E)IP Wrap Around in 16-bit Segments?

The stack pointer wraparound isn't a compatibility hack. In 16-bit mode PUSH/POP only affect SP (low 16 bits of ESP), just like string instructions only affect SI/DI.

An exception only occurs if there is wraparound during a memory access, like a 16 bit word at [FFFFh]. I suspect that EIP never actually becomes 10000h either, but that the prefetch unit sets a special tag bit to indicate that the next instruction is beyond the segment limit, same as it would if it ran off the end of a segment smaller than 64K.

Would be easy to check by looking at the register information from that dialog, maybe it also depends on what CPU the code is run on.

The 80186 didn't have segment limits (or the #GP exception), but behaved differently from the original in that a word access at [FFFFh] would in fact access the high byte at [10000h], because the increment is done on the 20 bit internal address instead of just the offset.