The 486 test registers are described in the i486 Processor Programmer’s Reference Manual, starting on page 10-8. The 386 test registers are a subset.
Registers TR6 and TR7 provide access to the TLB. They are defined as follows:
The 16-color modes on the VGA use a hardware design borrowed from the EGA. On the EGA (and VGA), the bitwise drawing modes don't act upon memory directly, but instead act upon values stored in four eight-bit registers, each of which holds a byte of data from one of four color planes. Reading any byte of data from the display will load each of the four ...
Running your code as-is on a real 286/VGA (Cirrus Logic CL-GD5420) produces this image:
Inserting one dummy read before the second fill cycle (just mov ax, es:) gives the image you were expecting:
So it would seem that at least there might be a difference between the DOSBox implementation and the real hardware. If it does implement logic operations, ...