Googling, referencing the Intel manuals, and using a debugger are all discouraged. Please don't post the answers in the comments!

Name two instructions that have a memory expression for an operand, but do not access memory.
Conditional jumps with 16-/32-bit displacements were not available on the 8086. How did compilers generate long conditional jumps back then?
For ModRM-32 memory expressions (such as dword ptr [eax], byte ptr [eax+ebx], word ptr [eax+ebx*4], qword ptr [ebx*8]), what are the rules for determining the segment against which the address is applied? What about ModRM-16 memory expressions (like [bx+si])?
The instruction "bswap r32" endian-swaps the specified 32-bit register. I.e., if eax = 12345678h, after executing bswap eax, eax = 78563412h. The behavior of "bswap r16" (i.e., bswap ax) is undefined as per the Intel manuals. Name a behavior exhibited by an actual processor when "bswap r16" executes.
Name two single-byte, undocumented instructions, and describe their behavior.
Name a circumstance under which the "aam" instruction can fault.
Name an instruction that writes to memory in some specific segment, where the segment cannot be overridden by a segment prefix.
The "nop r/m32" instruction (e.g., "nop [eax]"), introduced in the Pentium Pro series of processors, behaves identically to the "nop" instruction which has been present since the original 8088. Why does the Pentium Pro instruction exist?
For SSE instructions with mandatory prefixes (66/F1/F3), what happens if you put two such prefixes on an instruction?
Name a 32-bit instruction that is not encodable in 64-bit mode due to its assimilation into the VEX prefix schema.
"mov eax, [reg32]" is an invalid instruction (i.e., cannot be encoded) for which general-purpose 32-bit register (eax, ebx, ecx, edx, esp, ebp, esi, edi)?
Comparing "inc eax" and "add eax, 1", what is the difference in processor state (i.e. the registers, flags, and memory, without considering EIP) after execution?
Name a register that existed before the Pentium series, and ceased to exist beginning with the Pentium series.
What happens when you put an address size (67) prefix on a conditional jump?
"movsb" implicitly references two memory operands, ds:[esi] and es:[edi]. What happens when you put a segment prefix on this instruction?
The "bit-scan in reverse" instruction, "bsr eax, ebx", sets eax to the bit number of the least significant 1-bit set within ebx. If ebx is zero, the value placed into eax is undefined as per the Intel manuals. Name a behavior exhibited by an actual processor when executing "bsr" with a right-hand size of zero.
Arithmetic comparison operations are not commutative. I.e., "cmp eax, ebx" is not the same as "cmp ebx, eax". In the instruction "cmpxchg cl, bl", which comparison is performed?
In terms of processor state, is "rol al, 0" the same as "rol al, 8"?
The auxiliary carry flag (AF) is similar to the carry flag (CF), albeit for X-bit quantities instead of 8/16/32/64. What is X?
Apart from "pushf" and "lahf", name an instruction that uses the value of the AF flag (as opposed to merely defining AF without using it).
"shld r32, r/m32, r/imm8" shifts bits from the second operand into the first operand (from the left, i.e., the bottom). For example, if eax = 0x40000001, edx = 0x80000000, and cl = 1, after executing "shld eax, edx, cl", eax = 0x80000003. The shld instruction behaves analogously for 16-bit operands, but its behavior is undefined as per the Intel manuals if the shift count (third operand) specifies a shift of more than 16. Name a behavior exhibited by an actual processor when "shld ax, dx, cl" executes with 0x10 <= cl < 0x20.
After executing "shl eax, 32", is the overflow flag (OF) defined? If so, what is its value?
After executing "shl ax, 16", is the overflow flag (OF) defined? If so, what is its value?
In terms of processor state, is there any difference between: "btc eax, ebx" and "push eax / btc [esp], ebx / pop eax" (apart from the values of EIP and dword ptr [esp-4])?
In 16-bit real mode, segments are 64k windows into a 1MB address space. This coincides with the range of a 16-bit near call or near jump. Name a strategy that 16-bit linkers employ to allow seamless merging of the control flow between object files whose combined code size exceeds 64kb.