> I am a little bit freaked out by that because the pointer to the buffer is set before the IOCTL call; the code knowingly sets a pointer to a buffer into what looks like its code area. Let's hope they knew they were done with that part of the code, or it's just another interesting bug to dissect.

This is common in code without segmentation protection. CODE and DATA are convention. You can just specify a function, then a small buffer, then another function. .COM files in particular were easier to write with CS and DS pointing to the same region of memory, assuming you could fit both your code and inline buffers in 64kB.

The code explains what they are doing. Even more interesting, they're using their own stack too:

  ;  1 - This program uses its own internal stack.  The stack space provided
  ; by DOS is used as an input buffer for transfering IBMBIO and IBMDOS.
  ;
  ; SYS is linked with the CODE segment followed by the DATA segment. The
  ; last symbol in DATA is BUF. It marks the end end of data and the
  ; start of the BUFfer.  The BUFfer extends from here to SP.  The first
  ; 6.5Kb (13 sectors) in BUFfer are used for up to 12 sectors of the FAT
  ; or the directory. In Main, the remaining space is set
  ; as follows:
  ;        cdBuf = SP - ( FAT_BUF + BUF )
  ;