Thanks. I've done lots of debug, but still puzzled. The exception vector is 0x0D,...
The related ring 0 code is: ;; SS selector for ring 3, in LDT, ring 3, offset 8 mov...