diff --git a/dlls/kernel/Makefile.in b/dlls/kernel/Makefile.in
index b86a36fb71901bce89eb63005755fc7c4eed3716..41febad51c911fd8e7320396e8f782254ce05566 100644
--- a/dlls/kernel/Makefile.in
+++ b/dlls/kernel/Makefile.in
@@ -31,6 +31,7 @@ C_SRCS = \
 	file16.c \
 	format_msg.c \
 	heap.c \
+	instr.c \
 	kernel_main.c \
 	lcformat.c \
 	local16.c \
@@ -48,6 +49,7 @@ C_SRCS = \
 	stress.c \
 	string.c \
 	sync.c \
+	system.c \
 	tape.c \
 	task.c \
 	thread.c \
@@ -61,8 +63,7 @@ C_SRCS = \
 
 C_SRCS16 = \
 	error16.c \
-	registry16.c \
-	system.c
+	registry16.c
 
 ASM_SRCS = relay16asm.s
 
diff --git a/memory/instr.c b/dlls/kernel/instr.c
similarity index 96%
rename from memory/instr.c
rename to dlls/kernel/instr.c
index 0d83ac47f6e7f3b0c5e7954b3445c7165d8d9191..87f006c0d39d86d72a482713a6611896a0fdb70e 100644
--- a/memory/instr.c
+++ b/dlls/kernel/instr.c
@@ -66,19 +66,6 @@ inline static void *get_stack( CONTEXT86 *context )
 }
 
 
-/***********************************************************************
- *           timer_thread
- */
-static DWORD CALLBACK timer_thread( void *dummy )
-{
-    for (;;)
-    {
-        Sleep(55);
-        DOSMEM_Tick( 0 );
-    }
-    return 0; /* unreached */
-}
-
 /***********************************************************************
  *           INSTR_ReplaceSelector
  *
@@ -94,13 +81,9 @@ static BOOL INSTR_ReplaceSelector( CONTEXT86 *context, WORD *sel )
 {
     if (*sel == 0x40)
     {
-#if 0  /* hack until this is moved to kernel */
         static WORD sys_timer = 0;
         if (!sys_timer)
             sys_timer = CreateSystemTimer( 55, DOSMEM_Tick );
-#endif
-        static HANDLE sys_thread;
-        if (!sys_thread) sys_thread = CreateThread( NULL, 0, timer_thread, NULL, 0, NULL );
         *sel = DOSMEM_BiosDataSeg;
         return TRUE;
     }
@@ -502,7 +485,8 @@ DWORD INSTR_EmulateInstruction( CONTEXT86 *context )
             switch(instr[1])
             {
 	    case 0x22: /* mov eax, crX */
-	    	switch (instr[2]) {
+                switch (instr[2])
+                {
 		case 0xc0:
 			ERR("mov eax,cr0 at 0x%08lx, EAX=0x%08lx\n",
                             context->Eip,context->Eax );
@@ -513,7 +497,8 @@ DWORD INSTR_EmulateInstruction( CONTEXT86 *context )
 		}
 		break; /*fallthrough to bad instruction handling */
 	    case 0x20: /* mov crX, eax */
-	        switch (instr[2]) {
+                switch (instr[2])
+                {
 		case 0xe0: /* mov cr4, eax */
 		    /* CR4 register . See linux/arch/i386/mm/init.c, X86_CR4_ defs
 		     * bit 0: VME	Virtual Mode Exception ?
@@ -699,13 +684,7 @@ DWORD INSTR_EmulateInstruction( CONTEXT86 *context )
             break;  /* Unable to emulate it */
 
         case 0xcd: /* int <XX> */
-            if (IS_SELECTOR_SYSTEM(context->SegCs))
-            {
-                /* Win32 applications cannot use interrupts */
-                ret = EXCEPTION_ACCESS_VIOLATION;
-                break;
-            }
-            else if (!Dosvm.EmulateInterruptPM && !DPMI_LoadDosSystem())
+            if (!Dosvm.EmulateInterruptPM && !DPMI_LoadDosSystem())
             {
                 ERR("could not initialize interrupt handling\n");
             }
diff --git a/dlls/kernel/wowthunk.c b/dlls/kernel/wowthunk.c
index 9a204bffa6904fedc8c1d5814fcedd05dcbb022c..eb2741f763a99c2a4f36589bcde4b05bc218610a 100644
--- a/dlls/kernel/wowthunk.c
+++ b/dlls/kernel/wowthunk.c
@@ -170,16 +170,21 @@ static DWORD call16_handler( EXCEPTION_RECORD *record, EXCEPTION_REGISTRATION_RE
         NtCurrentTeb()->cur_stack = frame32->frame16;
         _LeaveWin16Lock();
     }
-    else
+    else if (record->ExceptionCode == EXCEPTION_ACCESS_VIOLATION ||
+             record->ExceptionCode == EXCEPTION_PRIV_INSTRUCTION)
     {
         if (IS_SELECTOR_SYSTEM(context->SegCs))
         {
             if (fix_selector( context )) return ExceptionContinueExecution;
         }
-        else /* check for Win16 __GP handler */
+        else
         {
-            SEGPTR gpHandler = HasGPHandler16( MAKESEGPTR( context->SegCs, context->Eip ) );
-            if (gpHandler)
+            SEGPTR gpHandler;
+
+            if (!INSTR_EmulateInstruction( context )) return ExceptionContinueExecution;
+
+            /* check for Win16 __GP handler */
+            if ((gpHandler = HasGPHandler16( MAKESEGPTR( context->SegCs, context->Eip ) )))
             {
                 WORD *stack = wine_ldt_get_ptr( context->SegSs, context->Esp );
                 *--stack = context->SegCs;
diff --git a/dlls/ntdll/Makefile.in b/dlls/ntdll/Makefile.in
index cbaeb13c875c577e9936de1f0ab9f01283667644..af7ad13590bce9e858824eeef2b9668ea40e0779 100644
--- a/dlls/ntdll/Makefile.in
+++ b/dlls/ntdll/Makefile.in
@@ -21,7 +21,6 @@ C_SRCS = \
 	$(TOPOBJDIR)/memory/environ.c \
 	$(TOPOBJDIR)/memory/global.c \
 	$(TOPOBJDIR)/memory/heap.c \
-	$(TOPOBJDIR)/memory/instr.c \
 	$(TOPOBJDIR)/memory/selector.c \
 	$(TOPOBJDIR)/memory/string.c \
 	$(TOPOBJDIR)/memory/virtual.c \
diff --git a/dlls/ntdll/signal_i386.c b/dlls/ntdll/signal_i386.c
index 57de180a78952407870dbc2830135dab3ecaf206..54d265deafe92676fe9aeff416be90f135de1b57 100644
--- a/dlls/ntdll/signal_i386.c
+++ b/dlls/ntdll/signal_i386.c
@@ -407,7 +407,6 @@ typedef struct
 
 #include "wine/exception.h"
 #include "global.h"
-#include "miscemu.h"
 #include "syslevel.h"
 #include "wine/debug.h"
 
@@ -748,13 +747,6 @@ static inline DWORD get_fpu_code( const CONTEXT *context )
 static void do_segv( CONTEXT *context, int trap_code, void *cr2, int err_code )
 {
     EXCEPTION_RECORD rec;
-    DWORD page_fault_code = EXCEPTION_ACCESS_VIOLATION;
-
-#ifdef FAULT_ADDRESS
-    /* we want the page-fault case to be fast */
-    if (trap_code == T_PAGEFLT)
-        if (!(page_fault_code = VIRTUAL_HandleFault( cr2 ))) return;
-#endif
 
     rec.ExceptionRecord  = NULL;
     rec.ExceptionFlags   = EXCEPTION_CONTINUABLE;
@@ -778,15 +770,17 @@ static void do_segv( CONTEXT *context, int trap_code, void *cr2, int err_code )
     case T_SEGNPFLT:  /* Segment not present exception */
     case T_PROTFLT:   /* General protection fault */
     case T_UNKNOWN:   /* Unknown fault code */
-        if (!(rec.ExceptionCode = INSTR_EmulateInstruction( context ))) return;
+        rec.ExceptionCode = err_code ? EXCEPTION_ACCESS_VIOLATION : EXCEPTION_PRIV_INSTRUCTION;
         break;
     case T_PAGEFLT:  /* Page fault */
 #ifdef FAULT_ADDRESS
+        if (!(rec.ExceptionCode = VIRTUAL_HandleFault( cr2 ))) return;
         rec.NumberParameters = 2;
         rec.ExceptionInformation[0] = (err_code & 2) != 0;
         rec.ExceptionInformation[1] = (DWORD)cr2;
+#else
+        rec.ExceptionCode = EXCEPTION_ACCESS_VIOLATION;
 #endif
-        rec.ExceptionCode = page_fault_code;
         break;
     case T_ALIGNFLT:  /* Alignment check exception */
         /* FIXME: pass through exception handler first? */