Push, pop, inc, and dec with a 16-bit register argument are one byte, so is ret. That technically gives you enough to do anything, but you can include jz/jnz (which do take immediate bytes, maybe cheating?), stosw, lodsw, clc, and stc to implement Brainfuck (a little harder to perform input/output with single byte instructions, but maybe pretend the OS uses int1 or int3 for calls).