The offsets into the callable services table for the BPX4xxx calls are the same as the offsets for the BPX1xxx calls. The kernel reacts to the AMODE of the caller, which is saved in the linkage stack at the time of the PC to the kernel, and not to the stub. The kernel doesn't know whether a program is calling BPX1xxx or BPX4xxx. If you invoke a BPX4xxx stub in AMODE 31, the kernel will process the parameters of its BPX1xxx counterpart. If the parameters are different, an EFAULT exception will probably occur.