INT 21 U - DR-DOS 5.0+ internal - GET POINTER TO INTERNAL VARIABLE TABLE
        AX = 4458h
Return: ES:BX -> internal variable table (see below)
        AX = ??? (0B50h for DR-DOS 5.0, 0A56h for DR-DOS 6.0)
SeeAlso: AX=4452h

Format of internal variable table:
Offset  Size    Description
 00h    WORD    ???
 02h    WORD    segment of ???
 04h  7 BYTEs   ???
 0Bh    WORD    KB of extended memory at startup
 0Dh    BYTE    number of far jump entry points
 0Eh    WORD    segment containing far jumps to DR-DOS entry points (see below)
 10h    WORD    (only if kernel loaded in HMA) offset in HMA of first free HMA
                memory block (see below) or 0000h if none; segment is FFFFh
 12h    WORD    pointer to segment of environment variables set in CONFIG,
                or 0000h if already used
---DR-DOS 6.0---
 14h    WORD    (only if kernel loaded in HMA) offset in HMA of first used HMA
                memory block (see below) or 0000h if none; segment is FFFFh
Note:   the segment used for the DR-DOS 6.0 CONFIG environment variables
          (excluding COMSPEC, VER and OS) is only useful for programs/drivers
          called from CONFIG.SYS. The word is set to zero later when the area
          is copied to the COMMAND.COM environment space.  This allows
          CONFIG.SYS to pass information to AUTOEXEC.BAT.

Format of kernel entry jump table for DR-DOS 5.0-6.0:
Offset  Size    Description
 00h  5 BYTEs   far jump to kernel entry point for CP/M CALL 5
 05h  5 BYTEs   far jump to kernel entry point for INT 20
 0Ah  5 BYTEs   far jump to kernel entry point for INT 21
 0Fh  5 BYTEs   far jump to kernel entry point for INT 22 (RETF)
 14h  5 BYTEs   far jump to kernel entry point for INT 23 (RETF)
 19h  5 BYTEs   far jump to kernel entry point for INT 24
 1Eh  5 BYTEs   far jump to kernel entry point for INT 25
 23h  5 BYTEs   far jump to kernel entry point for INT 26
 28h  5 BYTEs   far jump to kernel entry point for INT 27
 2Dh  5 BYTEs   far jump to kernel entry point for INT 28
 32h  5 BYTEs   far jump to kernel entry point for INT 2A (IRET)
 37h  5 BYTEs   far jump to kernel entry point for INT 2B (IRET)
 3Ch  5 BYTEs   far jump to kernel entry point for INT 2C (IRET)
 41h  5 BYTEs   far jump to kernel entry point for INT 2D (IRET)
 46h  5 BYTEs   far jump to kernel entry point for INT 2E (IRET)
 4Bh  5 BYTEs   far jump to kernel entry point for INT 2F
Notes:  all of these entry points are indirected through this jump table
          to allow the kernel to be relocated into high memory while leaving
          the actual entry addresses in low memory for maximum compatibility
        some of these entry points (22h,23h,24h,2Eh,2Fh) are replaced as soon
          as COMMAND.COM is loaded, and return immediately to the caller, some
          returning an error code (the original handler for INT 2F returns
          AL=03h [fail]).

Format of HMA Memory Block (DR-DOS 6.0 kernel loaded in HMA):
Offset  Size    Description
 00h    WORD    offset of next HMA Memory Block (0000h if last block)
 02h    WORD    size of this block in bytes (at least 10h)
 04h    BYTE    type of HMA Memory Block (interpreted by MEM)
                00h system
                01h KEYB
                02h NLSFUNC
                03h SHARE
                04h TaskMAX
                05h COMMAND
 05h    var     TSR (or system) code and data. DR-DOS TSR's, such as KEYB,
                hooks interrupts using segment FFFEh instead FFFFh.

.