Hi Ben,
I ASSume that it is "illegal" because it exceeds the limit on 16 bit addresses (64k).
To test this, try a smaller number. I know that's not where you want al, but just to test it. You have switched to protected mode, but the DosBox debugger probably doesn't know about this. If this whole "switch to protected mode" exercise is in DosBox, I wouldn't be surprised if it didn't work at all! I thought you were working with real hardware, but I guess those days are gone...
In an earlier post, you say that labels don't work in protected mode. They do (of course!) and you should probably be using them!
Best,
Frank