4634

6 files changed, 148 insertions, 150 deletions

diff --git a/subx/011run.cc b/subx/011run.cc
index f210f141..9248ff84 100644
--- a/subx/011run.cc
+++ b/subx/011run.cc
@@ -217,9 +217,7 @@ void load(const program& p) {
     raise << "no code to run\n" << end();
     return;
   }
-  // You should keep your segments disjoint.
-  // Tests sometimes don't, but it should still be an error to use the
-  // overlapping regions.
+  // Ensure segments are disjoint.
   set<uint32_t> overlap;
   for (int i = 0;   i < SIZE(p.segments);  ++i) {
     const segment& seg = p.segments.at(i);
diff --git a/subx/013direct_addressing.cc b/subx/013direct_addressing.cc
index 45e034ed..5177252f 100644
--- a/subx/013direct_addressing.cc
+++ b/subx/013direct_addressing.cc
@@ -554,17 +554,17 @@ put(name, "5e", "pop top of stack to R6 (ESI)");
 put(name, "5f", "pop top of stack to R7 (EDI)");
 
 :(scenario pop_r32)
-% Reg[ESP].u = 0x60;
-% Mem.push_back(vma(0x1));  // manually allocate memory
-% write_mem_i32(0x60, 0x0000000a);  // ..before this write
+% Reg[ESP].u = 0x2000;
+% Mem.push_back(vma(0x2000));  // manually allocate memory
+% write_mem_i32(0x2000, 0x0000000a);  // ..before this write
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   5b                                          # pop stack to EBX
-== 0x60  # data segment
+== 0x2000  # data segment
 0a 00 00 00  # 0x0a
 +run: pop into EBX
 +run: popping value 0x0000000a
-+run: incrementing ESP to 0x00000064
++run: incrementing ESP to 0x00002004
 
 :(before "End Single-Byte Opcodes")
 case 0x58:
diff --git a/subx/014indirect_addressing.cc b/subx/014indirect_addressing.cc
index b48cbd85..0882f4e8 100644
--- a/subx/014indirect_addressing.cc
+++ b/subx/014indirect_addressing.cc
@@ -3,15 +3,15 @@
 
 :(scenario add_r32_to_mem_at_r32)
 % Reg[EBX].i = 0x10;
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   01  18                                     # add EBX to *EAX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add EBX to r/m32
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0x00000011
 
 :(before "End Mod Special-cases(addr)")
@@ -31,16 +31,16 @@ case 0:  // indirect addressing
 put(name, "03", "add rm32 to r32");
 
 :(scenario add_mem_at_r32_to_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0x10;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   03  18                                      # add *EAX to EBX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add r/m32 to EBX
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0x00000011
 
 :(before "End Single-Byte Opcodes")
@@ -56,16 +56,16 @@ case 0x03: {  // add r/m32 to r32
 //:: subtract
 
 :(scenario subtract_r32_from_mem_at_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 1;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   29  18                                      # subtract EBX from *EAX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0a 00 00 00  # 10
 +run: subtract EBX from r/m32
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0x00000009
 
 //:
@@ -74,16 +74,16 @@ case 0x03: {  // add r/m32 to r32
 put(name, "2b", "subtract rm32 from r32");
 
 :(scenario subtract_mem_at_r32_from_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 10;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   2b  18                                      # subtract *EAX from EBX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: subtract r/m32 from EBX
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0x00000009
 
 :(before "End Single-Byte Opcodes")
@@ -99,16 +99,16 @@ case 0x2b: {  // subtract r/m32 from r32
 //:: and
 
 :(scenario and_r32_with_mem_at_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0xff;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   21  18                                      # and EBX with *EAX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0d 0c 0b 0a  # 0x0a0b0c0d
 +run: and EBX with r/m32
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0x0000000d
 
 //:
@@ -117,16 +117,16 @@ case 0x2b: {  // subtract r/m32 from r32
 put(name, "23", "r32 = bitwise AND of r32 with rm32");
 
 :(scenario and_mem_at_r32_with_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0x0a0b0c0d;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   23  18                                      # and *EAX with EBX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 ff 00 00 00  # 0xff
 +run: and r/m32 with EBX
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0x0000000d
 
 :(before "End Single-Byte Opcodes")
@@ -142,16 +142,16 @@ case 0x23: {  // and r/m32 with r32
 //:: or
 
 :(scenario or_r32_with_mem_at_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0xa0b0c0d0;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   09  18                                      # or EBX with *EAX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0d 0c 0b 0a  # 0x0a0b0c0d
 +run: or EBX with r/m32
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0xaabbccdd
 
 //:
@@ -160,16 +160,16 @@ case 0x23: {  // and r/m32 with r32
 put(name, "0b", "r32 = bitwise OR of r32 with rm32");
 
 :(scenario or_mem_at_r32_with_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0xa0b0c0d0;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   0b  18                                      # or *EAX with EBX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0d 0c 0b 0a  # 0x0a0b0c0d
 +run: or r/m32 with EBX
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0xaabbccdd
 
 :(before "End Single-Byte Opcodes")
@@ -185,16 +185,16 @@ case 0x0b: {  // or r/m32 with r32
 //:: xor
 
 :(scenario xor_r32_with_mem_at_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0xa0b0c0d0;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   31  18                                      # xor EBX with *EAX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0d 0c bb aa  # 0xaabb0c0d
 +run: xor EBX with r/m32
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0x0a0bccdd
 
 //:
@@ -203,16 +203,16 @@ case 0x0b: {  // or r/m32 with r32
 put(name, "33", "r32 = bitwise XOR of r32 with rm32");
 
 :(scenario xor_mem_at_r32_with_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0xa0b0c0d0;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   33  18                                      # xor *EAX with EBX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0d 0c 0b 0a  # 0x0a0b0c0d
 +run: xor r/m32 with EBX
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0xaabbccdd
 
 :(before "End Single-Byte Opcodes")
@@ -228,57 +228,57 @@ case 0x33: {  // xor r/m32 with r32
 //:: not
 
 :(scenario not_of_mem_at_r32)
-% Reg[EBX].i = 0x60;
+% Reg[EBX].i = 0x2000;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   f7  13                                      # negate *EBX
 # ModR/M in binary: 00 (indirect mode) 010 (subop not) 011 (dest EBX)
-== 0x60  # data segment
+== 0x2000  # data segment
 ff 00 0f 0f  # 0x0f0f00ff
 +run: operate on r/m32
-+run: effective address is 0x60 (EBX)
++run: effective address is 0x2000 (EBX)
 +run: subop: not
 +run: storing 0xf0f0ff00
 
 //:: compare (cmp)
 
 :(scenario compare_mem_at_r32_with_r32_greater)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0x0a0b0c07;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   39  18                                      # compare EBX with *EAX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0d 0c 0b 0a  # 0x0a0b0c0d
 +run: compare EBX with r/m32
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: SF=0; ZF=0; OF=0
 
 :(scenario compare_mem_at_r32_with_r32_lesser)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0x0a0b0c0d;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   39  18                                      # compare EBX with *EAX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 07 0c 0b 0a  # 0x0a0b0c0d
 +run: compare EBX with r/m32
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: SF=1; ZF=0; OF=0
 
 :(scenario compare_mem_at_r32_with_r32_equal)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0x0a0b0c0d;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   39  18                                      # compare EBX with *EAX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0d 0c 0b 0a  # 0x0a0b0c0d
 +run: compare EBX with r/m32
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: SF=0; ZF=1; OF=0
 
 //:
@@ -287,16 +287,16 @@ ff 00 0f 0f  # 0x0f0f00ff
 put(name, "3b", "compare: set SF if r32 < rm32");
 
 :(scenario compare_r32_with_mem_at_r32_greater)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0x0a0b0c0d;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   3b  18                                      # compare *EAX with EBX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 07 0c 0b 0a  # 0x0a0b0c0d
 +run: compare r/m32 with EBX
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: SF=0; ZF=0; OF=0
 
 :(before "End Single-Byte Opcodes")
@@ -316,29 +316,29 @@ case 0x3b: {  // set SF if r32 < r/m32
 }
 
 :(scenario compare_r32_with_mem_at_r32_lesser)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0x0a0b0c07;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   3b  18                                      # compare *EAX with EBX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0d 0c 0b 0a  # 0x0a0b0c0d
 +run: compare r/m32 with EBX
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: SF=1; ZF=0; OF=0
 
 :(scenario compare_r32_with_mem_at_r32_equal)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[EBX].i = 0x0a0b0c0d;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   3b  18                                      # compare *EAX with EBX
 # ModR/M in binary: 00 (indirect mode) 011 (src EAX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0d 0c 0b 0a  # 0x0a0b0c0d
 +run: compare r/m32 with EBX
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: SF=0; ZF=1; OF=0
 
 //:: copy (mov)
@@ -360,15 +360,15 @@ case 0x3b: {  // set SF if r32 < r/m32
 put(name, "8b", "copy rm32 to r32");
 
 :(scenario copy_mem_at_r32_to_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   8b  18                                      # copy *EAX to EBX
 # ModR/M in binary: 00 (indirect mode) 011 (src EBX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 af 00 00 00  # 0xaf
 +run: copy r/m32 to EBX
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0x000000af
 
 :(before "End Single-Byte Opcodes")
@@ -389,17 +389,17 @@ put(name, "88", "copy r8 (lowermost byte of r32) to r8/m8-at-r32");
 
 :(scenario copy_r8_to_mem_at_r32)
 % Reg[EBX].i = 0x224488ab;
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 == 0x1
 # op  ModR/M  SIB   displacement  immediate
   88  18                                      # copy just the lowermost byte of EBX to the byte at *EAX
 # ModR/M in binary: 00 (indirect mode) 011 (src EBX) 000 (dest EAX)
-== 0x60
+== 0x2000
 f0 cc bb aa  # 0xf0 with more data in following bytes
 +run: copy lowermost byte of EBX to r8/m8-at-r32
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0xab
-% CHECK_EQ(0xaabbccab, read_mem_u32(0x60));
+% CHECK_EQ(0xaabbccab, read_mem_u32(0x2000));
 
 :(before "End Single-Byte Opcodes")
 case 0x88: {  // copy r/m8 to r8
@@ -420,15 +420,15 @@ put(name, "8a", "copy r8/m8-at-r32 to r8 (lowermost byte of r32)");
 
 :(scenario copy_mem_at_r32_to_r8)
 % Reg[EBX].i = 0xaabbcc0f;  // one nibble each of lowest byte set to all 0s and all 1s, to maximize value of this test
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 == 0x1
 # op  ModR/M  SIB   displacement  immediate
   8a  18                                      # copy just the byte at *EAX to lowermost byte of EBX (clearing remaining bytes)
 # ModR/M in binary: 00 (indirect mode) 011 (dest EBX) 000 (src EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 ab ff ff ff  # 0xab with more data in following bytes
 +run: copy r8/m8-at-r32 to lowermost byte of EBX
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: storing 0xab
 # remaining bytes of EBX are *not* cleared
 +run: EBX now contains 0xaabbccab
@@ -449,18 +449,18 @@ case 0x8a: {  // copy r/m8 to r8
 //:: jump
 
 :(scenario jump_mem_at_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   ff  20                                      # jump to *EAX
 # ModR/M in binary: 00 (indirect mode) 100 (jump to r/m32) 000 (src EAX)
   05                              00 00 00 01
   05                              00 00 00 02
-== 0x60  # data segment
+== 0x2000  # data segment
 08 00 00 00  # 8
 +run: inst: 0x00000001
 +run: jump to r/m32
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: jumping to 0x00000008
 +run: inst: 0x00000008
 -run: inst: 0x00000003
@@ -477,16 +477,16 @@ case 4: {  // jump to r/m32
 //:: push
 
 :(scenario push_mem_at_r32)
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 % Reg[ESP].u = 0x14;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   ff  30                                      # push *EAX to stack
 # ModR/M in binary: 00 (indirect mode) 110 (push r/m32) 000 (src EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 af 00 00 00  # 0xaf
 +run: push r/m32
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 +run: decrementing ESP to 0x00000010
 +run: pushing value 0x000000af
 
@@ -505,17 +505,17 @@ put(name, "8f", "pop top of stack to rm32");
 
 :(scenario pop_mem_at_r32)
 % Reg[EAX].i = 0x60;
-% Reg[ESP].u = 0x10;
+% Reg[ESP].u = 0x2000;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   8f  00                                      # pop stack into *EAX
 # ModR/M in binary: 00 (indirect mode) 000 (pop r/m32) 000 (dest EAX)
-== 0x10  # data segment
+== 0x2000  # data segment
 30 00 00 00  # 0x30
 +run: pop into r/m32
 +run: effective address is 0x60 (EAX)
 +run: popping value 0x00000030
-+run: incrementing ESP to 0x00000014
++run: incrementing ESP to 0x00002004
 
 :(before "End Single-Byte Opcodes")
 case 0x8f: {  // pop stack into r/m32
@@ -538,12 +538,12 @@ case 0x8f: {  // pop stack into r/m32
 % Reg[EBX].i = 0x10;  // source
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
-  01  1d            60 00 00 00              # add EBX to *0x60
+  01  1d            00 20 00 00              # add EBX to *0x2000
 # ModR/M in binary: 00 (indirect mode) 011 (src EBX) 101 (dest in disp32)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add EBX to r/m32
-+run: effective address is 0x60 (disp32)
++run: effective address is 0x2000 (disp32)
 +run: storing 0x00000011
 
 :(before "End Mod 0 Special-cases(addr)")
@@ -556,16 +556,16 @@ case 5:  // exception: mod 0b00 rm 0b101 => incoming disp32
 
 :(scenario add_r32_to_mem_at_r32_plus_disp8)
 % Reg[EBX].i = 0x10;  // source
-% Reg[EAX].i = 0x5e;  // dest
+% Reg[EAX].i = 0x1ffe;  // dest
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   01  58            02                       # add EBX to *(EAX+2)
 # ModR/M in binary: 01 (indirect+disp8 mode) 011 (src EBX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add EBX to r/m32
-+run: effective address is initially 0x5e (EAX)
-+run: effective address is 0x60 (after adding disp8)
++run: effective address is initially 0x1ffe (EAX)
++run: effective address is 0x2000 (after adding disp8)
 +run: storing 0x00000011
 
 :(before "End Mod Special-cases(addr)")
@@ -585,32 +585,32 @@ case 1:  // indirect + disp8 addressing
 
 :(scenario add_r32_to_mem_at_r32_plus_negative_disp8)
 % Reg[EBX].i = 0x10;  // source
-% Reg[EAX].i = 0x61;  // dest
+% Reg[EAX].i = 0x2001;  // dest
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   01  58            ff                       # add EBX to *(EAX-1)
 # ModR/M in binary: 01 (indirect+disp8 mode) 011 (src EBX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add EBX to r/m32
-+run: effective address is initially 0x61 (EAX)
-+run: effective address is 0x60 (after adding disp8)
++run: effective address is initially 0x2001 (EAX)
++run: effective address is 0x2000 (after adding disp8)
 +run: storing 0x00000011
 
 //:
 
 :(scenario add_r32_to_mem_at_r32_plus_disp32)
 % Reg[EBX].i = 0x10;  // source
-% Reg[EAX].i = 0x5e;  // dest
+% Reg[EAX].i = 0x1ffe;  // dest
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   01  98            02 00 00 00              # add EBX to *(EAX+2)
 # ModR/M in binary: 10 (indirect+disp32 mode) 011 (src EBX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add EBX to r/m32
-+run: effective address is initially 0x5e (EAX)
-+run: effective address is 0x60 (after adding disp32)
++run: effective address is initially 0x1ffe (EAX)
++run: effective address is 0x2000 (after adding disp32)
 +run: storing 0x00000011
 
 :(before "End Mod Special-cases(addr)")
@@ -630,16 +630,16 @@ case 2:  // indirect + disp32 addressing
 
 :(scenario add_r32_to_mem_at_r32_plus_negative_disp32)
 % Reg[EBX].i = 0x10;  // source
-% Reg[EAX].i = 0x61;  // dest
+% Reg[EAX].i = 0x2001;  // dest
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   01  98            ff ff ff ff              # add EBX to *(EAX-1)
 # ModR/M in binary: 10 (indirect+disp32 mode) 011 (src EBX) 000 (dest EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add EBX to r/m32
-+run: effective address is initially 0x61 (EAX)
-+run: effective address is 0x60 (after adding disp32)
++run: effective address is initially 0x2001 (EAX)
++run: effective address is 0x2000 (after adding disp32)
 +run: storing 0x00000011
 
 //:: lea
@@ -648,13 +648,13 @@ case 2:  // indirect + disp32 addressing
 put(name, "8d", "load effective address of memory in rm32 into r32");
 
 :(scenario lea)
-% Reg[EAX].u = 0x60;
+% Reg[EAX].u = 0x2000;
 == 0x1
 # op  ModR/M  SIB   displacement  immediate
   8d  18
 # ModR/M in binary: 00 (indirect mode) 011 (dest EBX) 000 (src EAX)
 +run: lea into EBX
-+run: effective address is 0x60 (EAX)
++run: effective address is 0x2000 (EAX)
 
 :(before "End Single-Byte Opcodes")
 case 0x8d: {  // lea m32 to r32
diff --git a/subx/015immediate_addressing.cc b/subx/015immediate_addressing.cc
index 1444e173..1be27ec4 100644
--- a/subx/015immediate_addressing.cc
+++ b/subx/015immediate_addressing.cc
@@ -39,15 +39,15 @@ case 0x81: {  // combine imm32 with r/m32
 //:
 
 :(scenario add_imm32_to_mem_at_r32)
-% Reg[EBX].i = 0x60;
+% Reg[EBX].i = 0x2000;
 == 0x01  # code segment
 # op  ModR/M  SIB   displacement  immediate
   81  03                          0a 0b 0c 0d  # add 0x0d0c0b0a to *EBX
 # ModR/M in binary: 00 (indirect mode) 000 (add imm32) 011 (dest EBX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: combine imm32 with r/m32
-+run: effective address is 0x60 (EBX)
++run: effective address is 0x2000 (EBX)
 +run: imm32 is 0x0d0c0b0a
 +run: subop add
 +run: storing 0x0d0c0b0b
@@ -76,15 +76,15 @@ case 0x2d: {  // subtract imm32 from EAX
 //:
 
 :(scenario subtract_imm32_from_mem_at_r32)
-% Reg[EBX].i = 0x60;
+% Reg[EBX].i = 0x2000;
 == 0x01  # code segment
 # op  ModR/M  SIB   displacement  immediate
   81  2b                          01 00 00 00  # subtract 1 from *EBX
 # ModR/M in binary: 00 (indirect mode) 101 (subtract imm32) 011 (dest EBX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0a 00 00 00  # 10
 +run: combine imm32 with r/m32
-+run: effective address is 0x60 (EBX)
++run: effective address is 0x2000 (EBX)
 +run: imm32 is 0x00000001
 +run: subop subtract
 +run: storing 0x00000009
@@ -134,15 +134,15 @@ case 0x25: {  // and imm32 with EAX
 //:
 
 :(scenario and_imm32_with_mem_at_r32)
-% Reg[EBX].i = 0x60;
+% Reg[EBX].i = 0x2000;
 == 0x01  # code segment
 # op  ModR/M  SIB   displacement  immediate
   81  23                          0a 0b 0c 0d  # and 0x0d0c0b0a with *EBX
 # ModR/M in binary: 00 (indirect mode) 100 (and imm32) 011 (dest EBX)
-== 0x60  # data segment
+== 0x2000  # data segment
 ff 00 00 00  # 0xff
 +run: combine imm32 with r/m32
-+run: effective address is 0x60 (EBX)
++run: effective address is 0x2000 (EBX)
 +run: imm32 is 0x0d0c0b0a
 +run: subop and
 +run: storing 0x0000000a
@@ -192,15 +192,15 @@ case 0x0d: {  // or imm32 with EAX
 //:
 
 :(scenario or_imm32_with_mem_at_r32)
-% Reg[EBX].i = 0x60;
+% Reg[EBX].i = 0x2000;
 == 0x01  # code segment
 # op  ModR/M  SIB   displacement  immediate
   81  0b                          0a 0b 0c 0d  # or 0x0d0c0b0a with *EBX
 # ModR/M in binary: 00 (indirect mode) 001 (or imm32) 011 (dest EBX)
-== 0x60  # data segment
+== 0x2000  # data segment
 a0 b0 c0 d0  # 0xd0c0b0a0
 +run: combine imm32 with r/m32
-+run: effective address is 0x60 (EBX)
++run: effective address is 0x2000 (EBX)
 +run: imm32 is 0x0d0c0b0a
 +run: subop or
 +run: storing 0xddccbbaa
@@ -248,15 +248,15 @@ case 0x35: {  // xor imm32 with EAX
 //:
 
 :(scenario xor_imm32_with_mem_at_r32)
-% Reg[EBX].i = 0x60;
+% Reg[EBX].i = 0x2000;
 == 0x01  # code segment
 # op  ModR/M  SIB   displacement  immediate
   81  33                          0a 0b 0c 0d  # xor 0x0d0c0b0a with *EBX
 # ModR/M in binary: 00 (indirect mode) 110 (xor imm32) 011 (dest EBX)
-== 0x60  # data segment
+== 0x2000  # data segment
 a0 b0 c0 d0  # 0xd0c0b0a0
 +run: combine imm32 with r/m32
-+run: effective address is 0x60 (EBX)
++run: effective address is 0x2000 (EBX)
 +run: imm32 is 0x0d0c0b0a
 +run: subop xor
 +run: storing 0xddccbbaa
@@ -371,42 +371,42 @@ case 7: {
 +run: SF=0; ZF=1; OF=0
 
 :(scenario compare_imm32_with_mem_at_r32_greater)
-% Reg[EBX].i = 0x60;
+% Reg[EBX].i = 0x2000;
 == 0x01  # code segment
 # op  ModR/M  SIB   displacement  immediate
   81  3b                          07 0b 0c 0d  # compare 0x0d0c0b07 with *EBX
 # ModR/M in binary: 00 (indirect mode) 111 (compare imm32) 011 (dest EBX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0a 0b 0c 0d  # 0x0d0c0b0a
 +run: combine imm32 with r/m32
-+run: effective address is 0x60 (EBX)
++run: effective address is 0x2000 (EBX)
 +run: imm32 is 0x0d0c0b07
 +run: SF=0; ZF=0; OF=0
 
 :(scenario compare_imm32_with_mem_at_r32_lesser)
-% Reg[EBX].i = 0x60;
+% Reg[EBX].i = 0x2000;
 == 0x01  # code segment
 # op  ModR/M  SIB   displacement  immediate
   81  3b                          0a 0b 0c 0d  # compare 0x0d0c0b0a with *EBX
 # ModR/M in binary: 00 (indirect mode) 111 (compare imm32) 011 (dest EBX)
-== 0x60  # data segment
+== 0x2000  # data segment
 07 0b 0c 0d  # 0x0d0c0b07
 +run: combine imm32 with r/m32
-+run: effective address is 0x60 (EBX)
++run: effective address is 0x2000 (EBX)
 +run: imm32 is 0x0d0c0b0a
 +run: SF=1; ZF=0; OF=0
 
 :(scenario compare_imm32_with_mem_at_r32_equal)
 % Reg[EBX].i = 0x0d0c0b0a;
-% Reg[EBX].i = 0x60;
+% Reg[EBX].i = 0x2000;
 == 0x01  # code segment
 # op  ModR/M  SIB   displacement  immediate
   81  3b                          0a 0b 0c 0d  # compare 0x0d0c0b0a with *EBX
 # ModR/M in binary: 00 (indirect mode) 111 (compare imm32) 011 (dest EBX)
-== 0x60  # data segment
+== 0x2000  # data segment
 0a 0b 0c 0d  # 0x0d0c0b0a
 +run: combine imm32 with r/m32
-+run: effective address is 0x60 (EBX)
++run: effective address is 0x2000 (EBX)
 +run: imm32 is 0x0d0c0b0a
 +run: SF=0; ZF=1; OF=0
 
diff --git a/subx/016index_addressing.cc b/subx/016index_addressing.cc
index 58169083..f98d4c0d 100644
--- a/subx/016index_addressing.cc
+++ b/subx/016index_addressing.cc
@@ -2,17 +2,17 @@
 
 :(scenario add_r32_to_mem_at_r32_with_sib)
 % Reg[EBX].i = 0x10;
-% Reg[EAX].i = 0x60;
+% Reg[EAX].i = 0x2000;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   01  1c      20                             # add EBX to *EAX
 # ModR/M in binary: 00 (indirect mode) 011 (src EBX) 100 (dest in SIB)
 # SIB in binary: 00 (scale 1) 100 (no index) 000 (base EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add EBX to r/m32
-+run: effective address is initially 0x60 (EAX)
-+run: effective address is 0x60
++run: effective address is initially 0x2000 (EAX)
++run: effective address is 0x2000
 +run: storing 0x00000011
 
 :(before "End Mod 0 Special-cases(addr)")
@@ -48,51 +48,51 @@ uint32_t effective_address_from_sib(uint8_t mod) {
 
 :(scenario add_r32_to_mem_at_base_r32_index_r32)
 % Reg[EBX].i = 0x10;  // source
-% Reg[EAX].i = 0x5e;  // dest base
+% Reg[EAX].i = 0x1ffe;  // dest base
 % Reg[ECX].i = 0x2;  // dest index
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   01  1c      08                             # add EBX to *(EAX+ECX)
 # ModR/M in binary: 00 (indirect mode) 011 (src EBX) 100 (dest in SIB)
 # SIB in binary: 00 (scale 1) 001 (index ECX) 000 (base EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add EBX to r/m32
-+run: effective address is initially 0x5e (EAX)
-+run: effective address is 0x60 (after adding ECX*1)
++run: effective address is initially 0x1ffe (EAX)
++run: effective address is 0x2000 (after adding ECX*1)
 +run: storing 0x00000011
 
 :(scenario add_r32_to_mem_at_displacement_using_sib)
 % Reg[EBX].i = 0x10;  // source
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
-  01  1c      25    60 00 00 00              # add EBX to *0x60
+  01  1c      25    00 20 00 00              # add EBX to *0x2000
 # ModR/M in binary: 00 (indirect mode) 011 (src EBX) 100 (dest in SIB)
 # SIB in binary: 00 (scale 1) 100 (no index) 101 (not EBP but disp32)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add EBX to r/m32
-+run: effective address is initially 0x60 (disp32)
-+run: effective address is 0x60
++run: effective address is initially 0x2000 (disp32)
++run: effective address is 0x2000
 +run: storing 0x00000011
 
 //:
 
 :(scenario add_r32_to_mem_at_base_r32_index_r32_plus_disp8)
 % Reg[EBX].i = 0x10;  // source
-% Reg[EAX].i = 0x59;  // dest base
+% Reg[EAX].i = 0x1ff9;  // dest base
 % Reg[ECX].i = 0x5;  // dest index
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   01  5c      08    02                       # add EBX to *(EAX+ECX+2)
 # ModR/M in binary: 01 (indirect+disp8 mode) 011 (src EBX) 100 (dest in SIB)
 # SIB in binary: 00 (scale 1) 001 (index ECX) 000 (base EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add EBX to r/m32
-+run: effective address is initially 0x59 (EAX)
-+run: effective address is 0x5e (after adding ECX*1)
-+run: effective address is 0x60 (after adding disp8)
++run: effective address is initially 0x1ff9 (EAX)
++run: effective address is 0x1ffe (after adding ECX*1)
++run: effective address is 0x2000 (after adding disp8)
 +run: storing 0x00000011
 
 :(before "End Mod 1 Special-cases(addr)")
@@ -104,19 +104,19 @@ case 4:  // exception: mod 0b01 rm 0b100 => incoming SIB (scale-index-base) byte
 
 :(scenario add_r32_to_mem_at_base_r32_index_r32_plus_disp32)
 % Reg[EBX].i = 0x10;  // source
-% Reg[EAX].i = 0x59;  // dest base
+% Reg[EAX].i = 0x1ff9;  // dest base
 % Reg[ECX].i = 0x5;  // dest index
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   01  9c      08    02 00 00 00              # add EBX to *(EAX+ECX+2)
 # ModR/M in binary: 10 (indirect+disp32 mode) 011 (src EBX) 100 (dest in SIB)
 # SIB in binary: 00 (scale 1) 001 (index ECX) 000 (base EAX)
-== 0x60  # data segment
+== 0x2000  # data segment
 01 00 00 00  # 1
 +run: add EBX to r/m32
-+run: effective address is initially 0x59 (EAX)
-+run: effective address is 0x5e (after adding ECX*1)
-+run: effective address is 0x60 (after adding disp32)
++run: effective address is initially 0x1ff9 (EAX)
++run: effective address is 0x1ffe (after adding ECX*1)
++run: effective address is 0x2000 (after adding disp32)
 +run: storing 0x00000011
 
 :(before "End Mod 2 Special-cases(addr)")
diff --git a/subx/019functions.cc b/subx/019functions.cc
index fbc7e605..18887d27 100644
--- a/subx/019functions.cc
+++ b/subx/019functions.cc
@@ -52,15 +52,15 @@ case 2: {  // call function pointer at r/m32
 
 :(scenario call_mem_at_r32)
 % Reg[ESP].u = 0x64;
-% Reg[EBX].u = 0x10;
+% Reg[EBX].u = 0x2000;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   ff  13                                       # call function offset at *EBX
   # next EIP is 3
-== 0x10  # data segment
+== 0x2000  # data segment
 a0 00 00 00  # 0xa0
 +run: call to r/m32
-+run: effective address is 0x10 (EBX)
++run: effective address is 0x2000 (EBX)
 +run: decrementing ESP to 0x00000060
 +run: pushing value 0x00000003
 +run: jumping to 0x000000a3
@@ -71,11 +71,11 @@ a0 00 00 00  # 0xa0
 put(name, "c3", "return from most recent unfinished call");
 
 :(scenario ret)
-% Reg[ESP].u = 0x60;
+% Reg[ESP].u = 0x2000;
 == 0x1  # code segment
 # op  ModR/M  SIB   displacement  immediate
   c3
-== 0x60  # data segment
+== 0x2000  # data segment
 10 00 00 00  # 0x10
 +run: return
 +run: popping value 0x00000010