Approaches to legacy code.
Pure DOS applications, can be run under DOS Box, which as well as providing an 'virtual' DOS environment, provides 'virtualisation' of other hardware of that era.
Currently DOSBOX uses it's own console, but given time this could be patched in the code for it. However given the facte that DOSBOX is cross platform, it may be easy to use some kind of shell extension, than a direct 'hack' in CreateProcess and related functions..
Conjecture: Windows 16 bit applications all use 16 bit (286) style selectors? If so then the segments can be defined on the fly for Win 3.11 style NE code, and outof segment access caught in a virtualiser?
In NT these are thunked from 16 bit code up to 32 bit code,a virtaliser of an 80486 being used on non IA-32 systems.
An alternate approach to take in ReactOS is to use portions of DosBox/Qemu and fully virtualise a Win 3.x like environment, a simmilar approach could be taken in handling troublesome Windows 95 era applications, which would at the very least require some way of chaining an Int20/2F handler..