The statistics part is interesting but seems a lot of analysis work and guesses to get what's happening there - I was left with a feeling that after the initial analysis showed that the map layout isn't straightforward, it would have been easier to just look at the code touching it, e.g. take that DOS executable, put a memory breakpoint on one of these bytes with unclear meaning, and see what the code is doing with it.