What happens when the limit of a byte granular expand-down segment (so the normal limit behaviour is inversed) is at or above FFFFh? Are offsets past FFFFh counted as valid (like when using a address-size override to use 32-bit offsets)? Or is anything counted as invalid in that case (it's basically faulting on an OR-operation of the >LIMIT and >64K)?
Or do 32-bit processors just check against >4GB instead of >64K in this case?

Also, slightly related:
http://www.rcollins.org/ddj/Aug98/Aug98.html

So CS:
- On pre-Pentium uses AR byte in the cache in real mode and load it during far jumps (with 93h).
- On Pentium and up ignores AR byte in real mode and doesn't load it during far jumps.
- On pre-Pentium CS limit in real mode is forced to 64KB(FFFFh) without affecting caches.
- On Pentium and up honors the limit in real mode as well. (Note that this would make the SMM mode function properly as well, as it requires 4GB CS limit in real mode to operate properly?)

Is that correct?