That reminds me of the undocumented LOADALL instruction, and how you could use it to access memory without switching to protected mode. Good times!