A TSR's handlers can determine when DOS is active by consulting a one-byte flag called the InDos flag. Every DOS function sets this flag upon entry and clears it upon termination. During installation, a TSR locates the flag through Function 34h (Get Address of InDos Flag), which returns the address as ES:BX. The installation portion then stores the address so that the handlers can later find the flag without again calling Function 34h.
Theoretically, a TSR can wait to execute until the InDos flag is clear, thus sidestepping the entire issue of interrupting DOS. However, several low-order functions—such as Function 0Ah (Get Buffered Keyboard Input)—wait idly for an expected keystroke before they terminate. If a TSR were allowed to execute only after DOS returned, it too would be forced to wait for the terminating event.
The solution lies in determining when the low-order functions are active. DOS provides another service for this purpose: Interrupt 28h, the Idle Interrupt.