AH = 26h
DX = segment at which to create PSP (see below)
Notes:  new PSP is updated with memory size information; INTs 22h, 23h, 24h
taken from interrupt vector table
(DOS 2+) DOS assumes that the caller's CS is the segment of the PSP to
SeeAlso: AH=50h,AH=51h,AH=55h,AH=62h,AH=67h

Format of PSP:
Offset  Size    Description
00h  2 BYTEs   INT 20 instruction for CP/M CALL 0 program termination
the CDh 20h here is often used as a signature for a valid PSP
02h    WORD    segment of first byte beyond memory allocated to program
04h    BYTE    unused filler
05h    BYTE    CP/M CALL 5 service request (FAR JMP to 000C0h)
BUG: (DOS 2+) PSPs created by INT 21/AH=4Bh point at 000BEh
06h    WORD    CP/M compatibility--size of first segment for .COM files
08h  2 BYTEs   remainder of FAR JMP at 05h
0Ah    DWORD   stored INT 22 termination address
0Eh    DWORD   stored INT 23 control-Break handler address
12h    DWORD   DOS 1.1+ stored INT 24 critical error handler address
16h    WORD    segment of parent PSP
18h 20 BYTEs   DOS 2+ Job File Table, one byte per file handle, FFh = closed
2Ch    WORD    DOS 2+ segment of environment for process
2Eh    DWORD   DOS 2+ process's SS:SP on entry to last INT 21 call
32h    WORD    DOS 3+ number of entries in JFT (default 20)
34h    DWORD   DOS 3+ pointer to JFT (default PSP:0018h)
38h    DWORD   DOS 3+ pointer to previous PSP (default FFFFFFFFh in 3.x)
used by SHARE in DOS 3.3
3Ch  4 BYTEs   unused by DOS versions <= 5.00
reportedly used by Novell NetWare shell 3.x
40h  2 BYTEs   DOS 5.0 version to return on INT 21/AH=30h
42h  6 BYTEs   unused by DOS versions <= 5.00
48h    BYTE    (MSWindows3) bit 0 set if non-Windows application (WINOLDAP)
49h  7 BYTEs   unused by DOS versions <= 5.00
50h  3 BYTEs   DOS 2+ service request (INT 21/RETF instructions)
53h  9 BYTEs   unused in DOS versions <= 5.00
5Ch 16 BYTEs   first default FCB, filled in from first commandline argument
overwrites second FCB if opened
6Ch 16 BYTEs   second default FCB, filled in from second commandline argument
overwrites beginning of commandline if opened
7Ch  4 BYTEs   unused
80h 128 BYTEs  commandline / default DTA
command tail is BYTE for length of tail, N BYTEs for the tail,
followed by a BYTE containing 0Dh
Notes:  in DOS versions 3.0 and up, the limit on simultaneously open files may
be increased by allocating memory for a new open file table, filling
it with FFh, copying the first 20 bytes from the default table, and
adjusting the pointer and count at 34h and 32h.  However, DOS
versions through  at least 3.30 will only copy the first 20 file
handles into a child PSP (including the one created on EXEC).
network redirectors based on the original MS-Net implementation use
values of 80h-FEh in the open file table to indicate remote files;
Novell NetWare reportedly also uses values of 80h-FEh
MSDOS 5.00 incorrectly fills the FCB fields when loading a program
high; the first FCB is empty and the second contains the first
some DOS extenders place protected-mode values in various PSP fields
such as the "parent" field, which can confuse PSP walkers.  Always
check either for the CDh 20h signature or that the suspected PSP is
at the beginning of a memory block which owns itself (the preceding
paragraph should be a valid MCB with "owner" the same as the
suspected PSP).

Format of environment block:
Offset  Size    Description
00h  N BYTEs   first environment variable, ASCIZ string of form "var=value"
N BYTEs   second environment variable, ASCIZ string
N BYTEs   last environment variable, ASCIZ string of form "var=value"
BYTE    00h
---DOS 3+---
WORD    number of strings following environment (normally 1)
N BYTEs   ASCIZ full pathname of program owning this environment
other strings may follow

See also: 214B