qemu - Weird text behavior in mode 13h

vgack.asm

[org 0x7c00]
[bits 16]

;Stack setup
mov bp, 0xfffe
mov sp, bp

;Switch into mode 13h
mov ah, 0x00
mov al, 0x13
int 0x10

drawloop:
	mov al, [cnt]
	call gfxcls

	;Set cursor position
	mov ah, 2
	mov bh, 0
	mov dh, 24
	mov dl, 1
	int 0x10

	;Load counter into al
	;Change color to cnt value
	;Print at page 0
	mov al, [cnt]
	mov bl, al
	mov bh, 0

	;Print hex value of cnt (low byte)
	call puthexb
	
	;Wait 1/18.2 s
	mov ax, 0
	int 0x1a
	mov bx, dx
	delay:
		int 0x1a
		cmp bx, dx
		je delay
	
	;Increment counter
	inc word [cnt]
	
	jmp drawloop

jmp $

cnt: dw 0

;Clear screen
;al - color
gfxcls:
	pushf
	pusha
	push es
	mov bx, 0xA000	;Make es point video memory
	mov es, bx	;
	mov cx, 32000	;We will write 32000 times (word each time)
	mov di, 0	;Start at the beginning of the vmem
	mov ah, al	;Fill it with 0s
	cld		;Clear direction flag
	rep stosw	;Kinda memset
	pop es
	popa
	popf
	ret

;Print contents of al register on screen (as hex number)
;al - value
puthexb:
	pushf
	pusha
	push ax
	and ax, 0x00f0		;Fetch older 4 bits
	shr ax, 4		;Shift them into lower position
	mov si, puthexb_assoc	;
	add si, ax		;Add offset to assoc table address
	mov al, [si]		;Print character
	mov ah, 0xe		;
	int 0x10		;
	pop ax			;Restore initial value to display
	and ax, 0x000f		;Get 4 younger bits
	mov si, puthexb_assoc	;
	add si, ax		;Add offset to assoc table address
	mov al, [si]		;Print character
	mov ah, 0xe		;
	int 0x10		;
	popa
	popf
	ret
	puthexb_assoc: db '0123456789abcdef'

times 510 - ( $ - $$ ) db 0
dw 0xaa55