@mos_8502 in the case of Apple ProDOS you do a simple jsr to the fixed kernel dispatch address and have param buffers that sit behind the jsr call. This means the kernel decodes the return address, reads params (kernel operation, address of real param buffer) from the callers memory after the jsr, and then pushes a new return address past the param buffer area. Ugly, but it worked. I no longer recall what OS-65D did though they also hooked and extended the basic roms.