After loading a TSR into SoftICE, then EXIT, then run the TSR again causing a fault inside of SoftICE.
The problem was that SoftICE as using the ECX register but had never zeroed the high half. Patch S-ICE.EXE as follows:
ren s-ice.exe s-ice.bin
-s 0 lffff 8A 0E 41 0D FE C1 B5 00 F3
( prints out address in xxxx:yyyy format )
-e xxxx:yyyy 66 31 c9 8a 0e 41 0d 41
ren s-ice.bin s-ice.exe