I notice that, when using a 32-bit expand-down segment, the linear address correctly wraps to actually become a location below the specified base offset(so the base offset is the end offset of the linear addresses generated when the base offset and the extremely large offset(n+0xfffffffe wraps to start below the base when esp decrements 16-bits from 0).

But what happens when I do this with a 16-bit 80286+ descriptor? Say base=30000, limit 0, offset fffe(first stack address written). What is the resulting linear address? Is it 3fffe as by simple addition, or is the 16-bit offset one-extended to 32-bits(24-bits on 80286) to address (30000+FFFFFFFE=LA 2FFFE)? Or maybe a third option: addition is the same(not one-extended), but the base has become FFFF0000 added to become the effective base for 16-bit top-down segments?