The 8086 emulation would work by trapping every segment register load, emulating the instruction's real mode semantics, and then loading the new CPU state using the undocumented LOADALL instruction.
In principle this should work on any stepping. I'm not sure how Digital Research implemented it, but they might have relied on some detail of the exception handling that changed between steppings. For example, if early steppings left "invalid" values in segment registers instead of zeroing them, DR might have used these instead of going to the effort of emulating the faulting instruction?
Concurrent DOS/286 became FlexOS, which seems to be available here (but I haven't tested it to see if this actually includes the real-mode emulation, it might have been a feature that was only in the prototype):
http://bitsavers.trailing-edge.com/bits/DigitalResearch/Flex...
In any case, this way of running real mode code might just be too impractical. For "large model" programs using more than 64K data, every pointer dereference would have to be trapped and emulated, taking possibly thousands of clock cycles instead of just a few. You could optimize accesses to code and static data segments by defining protected-mode selectors for those, but running code that e.g. walks a linked list allocated on the heap might be intolerably slow.
Also all of the memory allocated to the program would have to be in one contiguous block, since there is no linear->physical address translation in the 286.