diff --git a/kern_wasm.asm b/kern_wasm.asm
index abfc602..6811abf 100644
--- a/kern_wasm.asm
+++ b/kern_wasm.asm
@@ -290,19 +290,21 @@ _Net_Call_VLM_Raw endp
 
 ; int C32_LoadNios_Probe(UI axfunc, void *outbuf)
 ;
-; 16-bit-safe Client32/NIOS probe.
-; Calls INT 2F AX=D8C1 like DeveloperNet LoadNiosFunctions,
-; but stores only 16-bit visible registers so kern.obj stays 16-bit.
+; 16-bit object, but captures 32-bit ESI and ECX using manual 386 opcodes.
+; This keeps the OMF/linker in 16-bit mode while still reading Client32/NIOS
+; values returned by:
+;   INT 2F AX=D8C1
 ;
 ; outbuf:
-;   +00 AX
-;   +02 BX
-;   +04 CX
-;   +06 DX
-;   +08 SI
-;   +0A DI
-;   +0C DS
-;   +0E ES
+;   +00 word AX after INT 2F
+;   +02 dword ESI after INT 2F
+;   +06 dword ECX after INT 2F
+;   +0A word BX
+;   +0C word CX low
+;   +0E word DX
+;   +10 word SI low
+;   +12 word DS
+;   +14 word ES
 _C32_LoadNios_Probe proc far
         push    bp
         mov     bp, sp
@@ -312,25 +314,52 @@ _C32_LoadNios_Probe proc far
         push    si
         push    di
 
+        ; xor ecx, ecx
+        db      66h, 33h, 0C9h
+        ; xor esi, esi
+        db      66h, 33h, 0F6h
+
         mov     ax, [bp+6]
         int     2Fh
 
         push    ds
+        push    es
+        push    si
+        push    cx
+        push    bx
+        push    dx
         push    ax
+
         les     di, dword ptr [bp+8]
 
+        ; restore AX result into AX and store word at out+0
         pop     ax
         mov     es:[di+0], ax
-        mov     es:[di+2], bx
-        mov     es:[di+4], cx
-        mov     es:[di+6], dx
-        mov     es:[di+8], si
-        ; store caller-visible DI is lost because DI now points to outbuf
-        mov     word ptr es:[di+10], 0
-        pop     ax
-        mov     es:[di+12], ax
-        mov     ax, es
-        mov     es:[di+14], ax
+
+        ; Store ESI dword at es:[di+2].
+        ; Encoding: ES override + operand-size prefix + MOV r/m32,r32
+        ;   mov es:[di+02], esi  = 26 66 89 75 02
+        db      26h, 66h, 89h, 75h, 02h
+
+        ; Store ECX dword at es:[di+6].
+        ;   mov es:[di+06], ecx  = 26 66 89 4Dh 06
+        db      26h, 66h, 89h, 4Dh, 06h
+
+        pop     dx
+        pop     bx
+        pop     cx
+
+        mov     es:[di+10], bx
+        mov     es:[di+12], cx
+        mov     es:[di+14], dx
+
+        pop     ax              ; saved SI
+        mov     es:[di+16], ax
+
+        pop     ax              ; saved ES
+        pop     bx              ; saved DS
+        mov     es:[di+18], bx
+        mov     es:[di+20], ax
 
         pop     di
         pop     si
diff --git a/nwtests.c b/nwtests.c
index fa12b7c..bd004e5 100644
--- a/nwtests.c
+++ b/nwtests.c
@@ -1146,44 +1146,37 @@ static int tests_c32type(void)
 {
   uint8 out[32];
   int rc;
-  uint16 ax;
-  uint16 bx;
-  uint16 cx;
-  uint16 dx;
-  uint16 si;
-  uint16 di;
-  uint16 dsreg;
-  uint16 esreg;
+  uint16 ax, bx, cx, dx, si, dsreg, esreg;
+  uint32 esi, ecx;
 
   memset(out, 0, sizeof(out));
 
-  fprintf(stdout, "TEST Client32/NIOS probe 16-bit safe\n");
-  fprintf(stdout, "Call INT 2F AX=D8C1 like DeveloperNet dninit.asm\n\n");
+  fprintf(stdout, "TEST Client32/NIOS probe ESI/ECX\n");
+  fprintf(stdout, "16-bit OMF, manual 386 stores after INT 2F AX=D8C1\n\n");
 
   rc = C32_LoadNios_Probe(0xD8C1, out);
 
   ax    = tests_get_word_lh(out + 0);
-  bx    = tests_get_word_lh(out + 2);
-  cx    = tests_get_word_lh(out + 4);
-  dx    = tests_get_word_lh(out + 6);
-  si    = tests_get_word_lh(out + 8);
-  di    = tests_get_word_lh(out + 10);
-  dsreg = tests_get_word_lh(out + 12);
-  esreg = tests_get_word_lh(out + 14);
+  esi   = tests_get_dword_lh2(out + 2);
+  ecx   = tests_get_dword_lh2(out + 6);
+  bx    = tests_get_word_lh(out + 10);
+  cx    = tests_get_word_lh(out + 12);
+  dx    = tests_get_word_lh(out + 14);
+  si    = tests_get_word_lh(out + 16);
+  dsreg = tests_get_word_lh(out + 18);
+  esreg = tests_get_word_lh(out + 20);
 
   fprintf(stdout, "C32 probe rc=%04X\n", rc);
   fprintf(stdout, "INT2F D8C1 result AX=%04X\n", ax);
-  fprintf(stdout, "BX=%04X CX=%04X DX=%04X SI=%04X DI=%04X\n", bx, cx, dx, si, di);
+  fprintf(stdout, "ESI=%08lX ECX=%08lX\n", esi, ecx);
+  fprintf(stdout, "BX=%04X CX=%04X DX=%04X SI=%04X\n", bx, cx, dx, si);
   fprintf(stdout, "DS=%04X ES=%04X\n", dsreg, esreg);
-  tests_dump_bytes("RAW:", out, 16);
+  tests_dump_bytes("RAW:", out, 22);
 
-  if (ax == 0) {
-    fprintf(stdout, "\nClient32/NIOS entry appears present.\n");
-    fprintf(stdout, "Next step: use these values to reproduce C32BEGINUSE/_C32REQUEST.\n");
-  } else {
+  if (ax == 0)
+    fprintf(stdout, "\nClient32/NIOS D8C1 reports success.\n");
+  else
     fprintf(stdout, "\nClient32/NIOS D8C1 did not report success.\n");
-    fprintf(stdout, "Then VLM/NETX fallback remains the only path.\n");
-  }
 
   return(0);
 }