diff --git a/kern.h b/kern.h
index 5b66362..573b1eb 100644
--- a/kern.h
+++ b/kern.h
@@ -17,6 +17,12 @@ extern int   KERN_CALL C32_LoadNios_Probe(UI axfunc, void *outbuf);
 extern int   KERN_CALL C32_GetFunc_Probe(char *name, void *outbuf);
 extern int   KERN_CALL C32_CallVersion_Nios_Probe(void *outbuf);
 extern int   KERN_CALL C32_MapLock_Probe(void *ptr, UI len, void *outbuf);
+extern int   KERN_CALL C32_NCP87_Raw_Probe(UI connLo, UI connHi,
+                                      void *hdr, UI hdrLen,
+                                      void *path, UI pathLen,
+                                      void *rep0, UI rep0Len,
+                                      void *rep1, UI rep1Len,
+                                      void *outbuf);
 extern int   KERN_CALL Net_Call_VLM_Raw(UI ax, UI bx, UI cx, UI dx,
                                       void *req, void *repl,
                                       UI p1, UI p2, UI p3);
diff --git a/kern_wasm.asm b/kern_wasm.asm
index 3a1a811..78a17d8 100644
--- a/kern_wasm.asm
+++ b/kern_wasm.asm
@@ -24,6 +24,7 @@ public  _C32_LoadNios_Probe
 public  _C32_GetFunc_Probe
 public  _C32_CallVersion_Nios_Probe
 public  _C32_MapLock_Probe
+public  _C32_NCP87_Raw_Probe
 public  _Net_Call_VLM_Raw
 
 _IPXinit proc far
@@ -708,4 +709,340 @@ mapflat_store:
 _C32_MapLock_Probe endp
 
 
+; int C32_NCP87_Raw_Probe(UI connLo, UI connHi,
+;                         void *hdr, UI hdrLen,
+;                         void *path, UI pathLen,
+;                         void *rep0, UI rep0Len,
+;                         void *rep1, UI rep1Len,
+;                         void *outbuf)
+;
+; Specialized raw Client32 NCP87/S6 request probe.
+; Reproduces d32wrap.o _COMPATNcpRequestReply mechanics:
+;   - INT 2F AX=D8C1
+;   - resolve COMPATNcpRequestReply via ESI resolver
+;   - MapLockFlat each fragment data buffer
+;   - build flat 8-byte frag tables
+;   - MapLockFlat frag tables and actualReplyLen
+;   - call ECX NIOS trampoline with command 8 and COMPATNcpRequestReply pointer
+;   - unlock mappings
+;
+; outbuf:
+;   +00 load AX
+;   +02 resolver off
+;   +04 resolver seg
+;   +06 trampoline off
+;   +08 trampoline seg
+;   +0A function off
+;   +0C function seg
+;   +0E ret AX
+;   +10 ret DX
+;   +12 actualReplyLen low
+;   +14 actualReplyLen high
+_C32_NCP87_Raw_Probe proc far
+        push    bp
+        mov     bp, sp
+        sub     sp, 100
+
+        push    ds
+        push    es
+        push    si
+        push    di
+
+        ; clear ESI/ECX
+        db      66h, 33h, 0F6h
+        db      66h, 33h, 0C9h
+
+        mov     ax, 0D8C1h
+        int     2Fh
+
+        ; save resolver ESI at [bp-84]
+        db      66h, 89h, 76h, 0ACh
+        ; save trampoline ECX at [bp-88]
+        db      66h, 89h, 4Eh, 0A8h
+
+        mov     [bp-2], ax          ; load AX
+        or      ax, ax
+        jne     c32raw_fail
+
+        ; resolve "COMPATNcpRequestReply"
+        push    cs
+        push    offset c32raw_name
+        push    0
+        push    0
+        call    dword ptr [bp-84]
+        add     sp, 8
+        mov     [bp-92], ax
+        mov     [bp-90], dx
+        or      ax, dx
+        jne     c32raw_have_func
+        jmp     c32raw_fail
+
+c32raw_have_func:
+        ; actualReplyLen local at [bp-52]
+        mov     word ptr [bp-52], 0
+        mov     word ptr [bp-50], 0
+
+        ; Map hdr data -> [bp-56]
+        push    0
+        push    word ptr [bp+0eH]
+        push    word ptr [bp+0cH]
+        push    word ptr [bp+0aH]
+        push    0
+        push    2
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+        mov     [bp-56], ax
+        mov     [bp-54], dx
+
+        ; Map path data -> [bp-60]
+        push    0
+        push    word ptr [bp+14H]
+        push    word ptr [bp+12H]
+        push    word ptr [bp+10H]
+        push    0
+        push    2
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+        mov     [bp-60], ax
+        mov     [bp-58], dx
+
+        ; Map reply0 -> [bp-64]
+        push    0
+        push    word ptr [bp+1aH]
+        push    word ptr [bp+18H]
+        push    word ptr [bp+16H]
+        push    0
+        push    2
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+        mov     [bp-64], ax
+        mov     [bp-62], dx
+
+        ; Map reply1 -> [bp-68]
+        push    0
+        push    word ptr [bp+20H]
+        push    word ptr [bp+1eH]
+        push    word ptr [bp+1cH]
+        push    0
+        push    2
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+        mov     [bp-68], ax
+        mov     [bp-66], dx
+
+        ; Build req flat table at [bp-32], two entries:
+        ; entry = flatptr dword + len dword
+        mov     ax, [bp-56]
+        mov     [bp-32], ax
+        mov     ax, [bp-54]
+        mov     [bp-30], ax
+        mov     ax, [bp+0eH]
+        mov     [bp-28], ax
+        mov     word ptr [bp-26], 0
+
+        mov     ax, [bp-60]
+        mov     [bp-24], ax
+        mov     ax, [bp-58]
+        mov     [bp-22], ax
+        mov     ax, [bp+14H]
+        mov     [bp-20], ax
+        mov     word ptr [bp-18], 0
+
+        ; Build reply flat table at [bp-48]
+        mov     ax, [bp-64]
+        mov     [bp-48], ax
+        mov     ax, [bp-62]
+        mov     [bp-46], ax
+        mov     ax, [bp+1aH]
+        mov     [bp-44], ax
+        mov     word ptr [bp-42], 0
+
+        mov     ax, [bp-68]
+        mov     [bp-40], ax
+        mov     ax, [bp-66]
+        mov     [bp-38], ax
+        mov     ax, [bp+20H]
+        mov     [bp-36], ax
+        mov     word ptr [bp-34], 0
+
+        ; Map req table [bp-32] len 16 -> [bp-72]
+        push    0
+        push    10H
+        push    ss
+        lea     ax, -32[bp]
+        push    ax
+        push    0
+        push    2
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+        mov     [bp-72], ax
+        mov     [bp-70], dx
+
+        ; Map reply table [bp-48] len 16 -> [bp-76]
+        push    0
+        push    10H
+        push    ss
+        lea     ax, -48[bp]
+        push    ax
+        push    0
+        push    2
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+        mov     [bp-76], ax
+        mov     [bp-74], dx
+
+        ; Map actualReplyLen [bp-52] len 4 -> [bp-80]
+        push    0
+        push    4
+        push    ss
+        lea     ax, -52[bp]
+        push    ax
+        push    0
+        push    2
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+        mov     [bp-80], ax
+        mov     [bp-78], dx
+
+        ; Call NIOS trampoline command 8 with COMPATNcpRequestReply pointer.
+        push    word ptr [bp-78]        ; actual flat hi
+        push    word ptr [bp-80]        ; actual flat lo
+        push    word ptr [bp-74]        ; reply table flat hi
+        push    word ptr [bp-76]        ; reply table flat lo
+        push    0
+        push    2                       ; num reply frags
+        push    word ptr [bp-70]        ; req table flat hi
+        push    word ptr [bp-72]        ; req table flat lo
+        push    0
+        push    2                       ; num req frags
+        push    0
+        push    57H                     ; NCP function 87
+        push    0
+        push    0
+        push    word ptr [bp+8]         ; conn high
+        push    word ptr [bp+6]         ; conn low
+        push    0
+        push    8
+        push    word ptr [bp-90]        ; function seg
+        push    word ptr [bp-92]        ; function off
+        call    dword ptr [bp-88]
+        add     sp, 28H
+
+        mov     [bp-96], ax
+        mov     [bp-94], dx
+
+        ; unlock mapped actual/table/data.  Ignore returns.
+        push    0
+        push    4
+        push    word ptr [bp-78]
+        push    word ptr [bp-80]
+        push    0
+        push    3
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+
+        push    0
+        push    10H
+        push    word ptr [bp-74]
+        push    word ptr [bp-76]
+        push    0
+        push    3
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+
+        push    0
+        push    10H
+        push    word ptr [bp-70]
+        push    word ptr [bp-72]
+        push    0
+        push    3
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+
+        push    0
+        push    word ptr [bp+20H]
+        push    word ptr [bp-66]
+        push    word ptr [bp-68]
+        push    0
+        push    3
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+
+        push    0
+        push    word ptr [bp+1aH]
+        push    word ptr [bp-62]
+        push    word ptr [bp-64]
+        push    0
+        push    3
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+
+        push    0
+        push    word ptr [bp+14H]
+        push    word ptr [bp-58]
+        push    word ptr [bp-60]
+        push    0
+        push    3
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+
+        push    0
+        push    word ptr [bp+0eH]
+        push    word ptr [bp-54]
+        push    word ptr [bp-56]
+        push    0
+        push    3
+        call    dword ptr [bp-84]
+        add     sp, 0cH
+
+        jmp     short c32raw_store
+
+c32raw_fail:
+        mov     word ptr [bp-92], 0
+        mov     word ptr [bp-90], 0
+        mov     word ptr [bp-96], 0FFFFH
+        mov     word ptr [bp-94], 0FFFFH
+        mov     word ptr [bp-52], 0
+        mov     word ptr [bp-50], 0
+
+c32raw_store:
+        les     di, dword ptr [bp+22H]
+
+        mov     ax, [bp-2]
+        mov     es:[di+0], ax
+        mov     ax, [bp-84]
+        mov     es:[di+2], ax
+        mov     ax, [bp-82]
+        mov     es:[di+4], ax
+        mov     ax, [bp-88]
+        mov     es:[di+6], ax
+        mov     ax, [bp-86]
+        mov     es:[di+8], ax
+        mov     ax, [bp-92]
+        mov     es:[di+10], ax
+        mov     ax, [bp-90]
+        mov     es:[di+12], ax
+        mov     ax, [bp-96]
+        mov     es:[di+14], ax
+        mov     ax, [bp-94]
+        mov     es:[di+16], ax
+        mov     ax, [bp-52]
+        mov     es:[di+18], ax
+        mov     ax, [bp-50]
+        mov     es:[di+20], ax
+
+        pop     di
+        pop     si
+        pop     es
+        pop     ds
+        mov     sp, bp
+        pop     bp
+        xor     ah, ah
+        ret
+
+c32raw_name db 'COMPATNcpRequestReply',0
+
+_C32_NCP87_Raw_Probe endp
+
+
 end
diff --git a/nwtests.c b/nwtests.c
index 70fe3a6..78600f8 100644
--- a/nwtests.c
+++ b/nwtests.c
@@ -1300,6 +1300,113 @@ static int tests_c32mapflat(void)
 }
 
 
+static int tests_nwreq87c32raw_one(UI connLo, UI connHi, UI label)
+{
+  uint8 connid = 0;
+  uint8 dhandle = 0;
+  uint8 flags = 0;
+  int drive;
+  uint8 hdr[16];
+  uint8 path[0x140];
+  uint8 rep0[0x60];
+  uint8 rep1[0x110];
+  uint8 out[32];
+  UI path_len;
+  uint16 load_ax, res_off, res_seg, tramp_off, tramp_seg, fn_off, fn_seg;
+  uint16 ret_ax, ret_dx, act_lo, act_hi;
+
+  drive = tests_get_current_drive();
+  get_drive_info((uint8)drive, &connid, &dhandle, &flags);
+
+  memset(hdr, 0, sizeof(hdr));
+  hdr[0] = 6;
+  hdr[1] = 0;
+  hdr[2] = 0;
+  tests_put_word_lh(hdr + 3, 0x0006);
+  tests_put_dword_lh(hdr + 5, 0x00000004UL);
+
+  path_len = tests_build_novell_handle_path(path, dhandle, 0, 0, 1,
+                                            "LOGIN.EXE", 0, 0);
+
+  memset(rep0, 0, sizeof(rep0));
+  memset(rep1, 0, sizeof(rep1));
+  memset(out, 0, sizeof(out));
+
+  fprintf(stdout, "\nTEST NWREQ87C32RAW label=%u conn32=%04X:%04X\n",
+          label, connHi, connLo);
+  fprintf(stdout, "drive=%c: connid=%u dhandle=%u flags=%02X path_len=%u\n",
+          'A' + drive, connid, dhandle, flags, path_len);
+  tests_dump_bytes("HDR :", hdr, 9);
+  tests_dump_bytes("PATH:", path, path_len > 48 ? 48 : path_len);
+
+  C32_NCP87_Raw_Probe(connLo, connHi,
+                      hdr, 9,
+                      path, path_len,
+                      rep0, 0x4d,
+                      rep1, 0x100,
+                      out);
+
+  load_ax   = tests_get_word_lh(out + 0);
+  res_off   = tests_get_word_lh(out + 2);
+  res_seg   = tests_get_word_lh(out + 4);
+  tramp_off = tests_get_word_lh(out + 6);
+  tramp_seg = tests_get_word_lh(out + 8);
+  fn_off    = tests_get_word_lh(out + 10);
+  fn_seg    = tests_get_word_lh(out + 12);
+  ret_ax    = tests_get_word_lh(out + 14);
+  ret_dx    = tests_get_word_lh(out + 16);
+  act_lo    = tests_get_word_lh(out + 18);
+  act_hi    = tests_get_word_lh(out + 20);
+
+  fprintf(stdout, "Load AX=%04X Resolver=%04X:%04X Tramp=%04X:%04X\n",
+          load_ax, res_seg, res_off, tramp_seg, tramp_off);
+  fprintf(stdout, "Function COMPAT=%04X:%04X\n", fn_seg, fn_off);
+  fprintf(stdout, "Return DX:AX=%04X:%04X actual=%04X:%04X\n",
+          ret_dx, ret_ax, act_hi, act_lo);
+  tests_dump_bytes("OUT :", out, 22);
+  tests_dump_bytes("REP0:", rep0, 64);
+  tests_dump_bytes("REP1:", rep1, 64);
+
+  return(0);
+}
+
+static int tests_nwreq87c32raw(int argc, char *argv[])
+{
+  UI lo = 0;
+  UI hi = 0;
+
+  if (argc > 2)
+    lo = (UI)atoi(argv[2]);
+  if (argc > 3)
+    hi = (UI)atoi(argv[3]);
+
+  return tests_nwreq87c32raw_one(lo, hi, 0);
+}
+
+static int tests_nwreq87c32matrix(void)
+{
+  UI vals[6];
+  int i;
+
+  vals[0] = 0;
+  vals[1] = 1;
+  vals[2] = 2;
+  vals[3] = 3;
+  vals[4] = 0x31;
+  vals[5] = 0x3130;
+
+  fprintf(stdout, "TEST NWREQ87C32MATRIX paged\n");
+  tests_wait_key();
+
+  for (i = 0; i < 6; i++) {
+    tests_nwreq87c32raw_one(vals[i], 0, (UI)i);
+    if (i != 5)
+      tests_wait_key();
+  }
+  return(0);
+}
+
+
 int func_tests(int argc, char *argv[], int mode)
 {
   if (argc >= 2) {
@@ -1321,6 +1428,12 @@ int func_tests(int argc, char *argv[], int mode)
     if (tests_same_arg(argv[1], "C32MAPFLAT"))
       return tests_c32mapflat();
 
+    if (tests_same_arg(argv[1], "NWREQ87C32RAW"))
+      return tests_nwreq87c32raw(argc, argv);
+
+    if (tests_same_arg(argv[1], "NWREQ87C32MATRIX"))
+      return tests_nwreq87c32matrix();
+
     if (tests_same_arg(argv[1], "NWREQ87"))
       return tests_nwreq87(argc, argv);