Looking at Dosbox, all other opcodes seem to have higher priority on the CPL check than the #UD check, but in the case of INVLPG it's reversed?
So does it throw #UD or #GP when in V86 mode with MOD=3? Which one is checked first?
In the end, #UD and #GP are two totally different exception handlers. The Virtual 8086 monitor might handle them differently.
Looking at Dosbox and Bochs, it seems that in Bochs the #UD is generated AFTER the CPL(thus lower priority), but Dosbox seems to first check the MOD, then CPL after that, which is the reversed order?
Edit: I've just modified it to handle #GP(0) over #UD. So V86 mode will always throw #GP(0), while real/privileged(CPL=0) protected mode will throw #UD when invalid. So privilege having higher priority than #UD.
Would that be correct behaviour(matching Bochs' behaviour)?
Edit: OK. The last I see is a verify sectors command sent to the INT13h handler, after which it starts single-stepping through the code/BIOS, because the trap flag was set?
So perhaps there's some kind of unknown issue with the INT13h function 04h handling?