You cannot get a pointer to video memory in XP unless you are in the DOS emulator. Even in DJGPP 32-bit you cannot get a pointer to the Linear Frame Buffer or LFB by using a near pointer hack. The near pointer hack works under DOS and Windows 98SE, but not XP.
To obtain a pointer to video memory in 16-bit DOS:
I forget the wait for retrace code but it's still available on the net.
typedef unsigned char BYTE;
BYTE far *pScreen=(BYTE far *)MK_FP(0xA000,0);
BYTE far *Buffer=new BYTE[64000L];
void Flip13h(BYTE far *pScreen,BYTE far *pBuffer)
//Wait for vertical retrace.
//....while (!(inp(0x03DA)).... I forget the code sorry
You can gain access to the primary buffer and all buffers in Direct3D via the IDirect3DSurface9::Lock() method. I would not make use of this as it will result in degraded performance.