Thanks.
Ploughing through my pile of paper I found the notes:
dh = RegisterKDD (0x83)
eax = Command Code (1 = valid value)
es:di control buffer address (4 DWORDS)
DWORDS in control buffer:
1. DWORD:

2. DWORD: lower WORD: IRQ number (what IRQ ?)
3. DWORD far pointer to code -> Handler routine (into the code segment of the invoking driver)
4. DWORD: far pointer to buffer (into the data segment of the invoking driver)
Control Buffer is then copied to symbol address _KDDC (segment "c" of DOSCALLS at offset 1233c)
USHORT FAR HandlerRoutine(USHORT arg1=ax, USHORT arg2=cx)
arg1 = function code 1,2,3
arg2 = KDB function ?
The Device Helper "RegisterKDD" (dh_RegisterKDD) can be found at 3:1528 (3. segment of DOSCALLS module, offset 1528) in the 14.104a SMP debug kernel (the latest available apart from what AN offers)
You can use Theseus disassembly to have a look into how it operates. You can also use Theseus module view to find out at what target address the various DOSCALLS segments are loaded.
Of course, the retail kernel contains no operational code (even though it also exports symbol dh_RegisterKDD) it only returns with the carry flag set to indicate an error:
push ds
mov eax,5
stc
pop ds
retn
I remember there was some way to find out which driver registered with the KDB (that's how I found out that KDBNET.SYS indeed calls this Device Helper to register with the debug kernel) but I cannot remember how I found out. I guess I looked at symbol _KDDC ...