I'm hard at work tracing out the 8088 die, so hopefully I can confirm this discussion at the circuitry level before too long.

Please do the VIC-II chip next

not mentioned is that some copy protection schemes wrote branches into the code under the prefetch queue so that if you single stepped through it you would hare off into the weeds

Such code would also fail randomly unless interrupts are disabled.

yup, but on an 80888 that's just an instruction anyone can do

hardware interrupts.

yes, there's a disable interrupt instruction that any code can execute

Do you have any example ?

"The PC register on the 8088 points to the next instruction to be fetched - often pointing past the address of the currently executing instruction. In fact, the IP 'register' you may be familiar with is not a real register at all - the value of IP is produced as needed from PC by subtracting the length of the instruction queue from PC."

Dashing my childhood worldview against the rocks again, Intel.

RIP :-)