diff --git a/modules/pcjs/bin/romtests.json b/modules/pcjs/bin/romtests.json
index d51e4dc31..a40b43ce4 100644
--- a/modules/pcjs/bin/romtests.json
+++ b/modules/pcjs/bin/romtests.json
@@ -78,7 +78,7 @@
   "debugger": {
     "id": "pc386.debugger",
     "name": "",
-    "commands": "bp 0010:829B;g",
+    "commands": "",
     "messages": ""
   }
 }
diff --git a/modules/pcjs/lib/debugger.js b/modules/pcjs/lib/debugger.js
index 7a64d86e1..653493f86 100644
--- a/modules/pcjs/lib/debugger.js
+++ b/modules/pcjs/lib/debugger.js
@@ -1460,7 +1460,7 @@ if (DEBUGGER) {
         var addr = this.getAddr(dbgAddr, false, 1);
         if (addr !== X86.ADDR_INVALID) {
             this.nSuppress++;
-            b = this.cpu.getByte(addr);
+            b = this.cpu.probeAddr(addr) | 0;
             this.nSuppress--;
             if (inc) this.incAddr(dbgAddr, inc);
         }
@@ -1497,7 +1497,7 @@ if (DEBUGGER) {
         var addr = this.getAddr(dbgAddr, false, 2);
         if (addr !== X86.ADDR_INVALID) {
             this.nSuppress++;
-            w = this.cpu.getShort(addr);
+            w = this.cpu.probeAddr(addr) | (this.cpu.probeAddr(addr + 1) << 8);
             this.nSuppress--;
             if (inc) this.incAddr(dbgAddr, inc);
         }
@@ -1518,7 +1518,7 @@ if (DEBUGGER) {
         var addr = this.getAddr(dbgAddr, false, 4);
         if (addr !== X86.ADDR_INVALID) {
             this.nSuppress++;
-            l = this.cpu.getLong(addr);
+            l = this.cpu.probeAddr(addr) | (this.cpu.probeAddr(addr + 1) << 8) | (this.cpu.probeAddr(addr + 2) << 16) | (this.cpu.probeAddr(addr + 3) << 24);
             this.nSuppress--;
             if (inc) this.incAddr(dbgAddr, inc);
         }
@@ -1887,7 +1887,8 @@ if (DEBUGGER) {
         for (var sField in Debugger.aTSSFields) {
             var off = Debugger.aTSSFields[sField];
             var ch = (sField.length < 8? ' ' : '');
-            var w = this.cpu.getShort(seg.base + off);
+            var addr = seg.base + off;
+            var w = this.cpu.probeAddr(addr) | (this.cpu.probeAddr(addr + 1) << 8);
             if (sDump) sDump += '\n';
             sDump += str.toHexWord(off) + " " + sField + ": " + ch + str.toHexWord(w);
         }
@@ -2686,7 +2687,7 @@ if (DEBUGGER) {
          */
         if (nState >= 0 && this.aaOpcodeCounts.length) {
             this.cInstructions++;
-            var bOpcode = this.cpu.getByte(addr);
+            var bOpcode = this.cpu.probeAddr(addr);
             this.aaOpcodeCounts[bOpcode][1]++;
             var a = this.aOpcodeHistory[this.iOpcodeHistory];
             a[0] = this.cpu.getIP();
diff --git a/modules/pcjs/lib/x86cpu.js b/modules/pcjs/lib/x86cpu.js
index e62692f7f..8a20013bc 100644
--- a/modules/pcjs/lib/x86cpu.js
+++ b/modules/pcjs/lib/x86cpu.js
@@ -2703,6 +2703,24 @@ X86CPU.prototype.setBinding = function(sHTMLType, sBinding, control)
     return fBound;
 };
 
+/**
+ * probeAddr(addr)
+ *
+ * Used by the Debugger to probe addresses without risk of triggering a page fault, and by internal
+ * functions, like fnFaultMessage(), that also need to avoid triggering faults, since they're not part
+ * of standard CPU operation.
+ *
+ * @this {X86CPU}
+ * @param {number} addr is a linear address
+ * @return {number|null} byte (8-bit) value at that address, or null if invalid
+ */
+X86CPU.prototype.probeAddr = function(addr)
+{
+    var block = this.aMemBlocks[(addr & this.memMask) >>> this.blockShift];
+    if (block.type == Memory.TYPE.UNPAGED) return null;
+    return block.readByteDirect(addr & this.blockLimit, addr);
+};
+
 /**
  * getByte(addr)
  *
diff --git a/modules/pcjs/lib/x86func.js b/modules/pcjs/lib/x86func.js
index 30080d7d2..244b2fb7e 100644
--- a/modules/pcjs/lib/x86func.js
+++ b/modules/pcjs/lib/x86func.js
@@ -3666,7 +3666,8 @@ X86.fnPageFault = function(addr, fPresent, fWrite)
 X86.fnFaultMessage = function(nFault, nError, fHalt)
 {
     var bitsMessage = Messages.FAULT;
-    var bOpcode = this.getByte(this.regLIP);
+
+    var bOpcode = this.probeAddr(this.regLIP);
 
     /*
      * OS/2 1.0 uses an INT3 (0xCC) opcode in conjunction with an invalid IDT to trigger a triple-fault