> I see no indication that a size override prefix is going to have any effect, regardless where it's placed.
See Intel manual Volume 1: Basic Architecture, chapter 8.1.10 Saving the x87 FPU’s State with FSTENV/FNSTENV and FSAVE/FNSAVE:
"The manner in which this information is stored in memory depends on the operating
mode of the processor (protected mode or real-address mode) and on the operand size
attribute in effect (32-bit or 16-bit)."
Under BITS 32, operand size override provides 14-byte state information instead of default 28-byte one.
According to the documentation, "o16 fstenv [eax]" should work, but it places the prefix 66 at wrong place. It must be behind the WAIT prefix (9B) to take effect.
That's why I ask for another syntax which would provide the 14-byte operand.
Best regards,
MazeGen