It was an interesting little adventure. The whole of the operating environment is controlled through a single software interrupt vector, INT 0xEF. Once I got a document explaining what data needed to be present in which registers when firing the interrupt, it was (sorta) smooth sailing.
Code can be found here. It's 16-bit real mode C, so mind your head!
This would not have been possible without the following sources: