But how can I get the address of CallProc32W from a 16-bit DOS program?
I'd say that's not possible.
A 16-bit DOS real-mode program in XP that wants to execute 32-bit may do
- call exports of a Win32 dll ( using so-called BOPs ) OR
- switch to protected-mode via DPMI and then call 32-bit code directly ( after having done some low-level selector stuff ).