If I have to believe the 80386 and all related documentation, if you IRET with EFLAGS.VM on the stack set with a non-zero CPL, it results in a normal protected-mode IRET, with (undocumented) EFLAGS.VM being cleared(to make it use normal protected mode)?

Is that correct behaviour?

Also the 80386 programmer's reference manual is a bit strange on that, as it seems to have many errors in the protected mode to V86-mode IRET (Checking against the GDT/LDT(invalid for V86 mode), stack pointer incorrectly placed on the stack(it's immediately below after the EFLAGS, before the register(see also the INT documentation for that in reverse order) as well as it being popped not being dependant on any privilege level(also, using RPL from V86-mode segments? That's simply insane, as V86 mode(and real mode) doesn't have it and berely use it due to the way it constructs addresses using it(causing conflicts, except when handled like Windows 3.x seems to do(being able to run Windows software unmodified in real and protected mode, probably enforcing RPL=3 for all segments?)))))?

Edit: Interestingly enough, the 80486 programmer's reference manual fixes that, making the stack consistent again(popping the stack pointer&SS after the EFLAGS).

But both document IRET in V86 mode always #GP(0) faulting(if VM=1), but documenting being dependent on IOPL not being 3 in the V86 mode exceptions section? Also, what happens when V86 is set with IOPL=3 isn't documented at all in either documentation?