I have studied three CP/M-86 versions in some detail:
This version of CP/M-86 uses BDOS 2.2. Function 0Ch returns 0022h (all other DR 16-bit operating systems return 10xxh or 14xxh).
The BDOS behaves like 8-bit CP/M 2, except that an extra call is added to find the address of the system variables, and there are memory management calls.
DOSPLUS, although it behaves very like DOS, is CP/M with a separate DOS emulation layer. The BDOS is version 4.1 (function 0Ch returns 1041h) dated 08-05-86 (I think this means 5 August, since Personal CP/M-86 v1.0/5 has '11-16-83' here).
This version of the BDOS supports CP/M and DOS filesystems, all CP/M Plus calls, and a few MP/M calls allowing limited multitasking.
The CCP built into DOSPLUS is a stub that merely loads COMMAND.COM.
The XIOS supports 5.25" floppy drives up to 1.2Mb (DOS format) / 320k (CP/M format), and DOS partitions up to 32Mb. There is no support for 720k 3.5" discs or CP/M partitions; it is possible to improve this.
The BDOS is version 4.1, the same version as in DOSPLUS, but no DOS emulation module is included and the CCP is a full CCP similar to the one in CP/M-80 v3.x - it contains strings reading "CP/M-86 Plus" and "111183".
The XIOS does not support DOS floppies or partitions; it contains disc parameters for CP/M floppies up to 700k and CP/M hard drive partitions.
The BDOS version number is 3.1 instead of 4.1, so this is probably the closest that we're going to come to CP/M-86 Plus.
The 4.1 BDOS contains two addresses which are checked at boot time and called if not zero. In DOSPLUS, the first of these refers to the DOS emulation module and the second is zero; while in Personal CP/M-86 version 2.0/2 both are zero. Was there ever a CP/M which used both addresses?
In fact, what is the second address for? A network support module?)