int 28h is called from within DOS, so the indos byte will always be greater than 0 when it is called. You should check that it is not greater than one.

Also, it was normal to hook int 8 as well as...

string db 4 dup( ' ' ), '$'

mov al, 41h ; the character 041h (i.e.'A')
mov cx, 26 ; start the counter at 26 in cx

again:
push ax ;save character
mov...

Maybe I'm being thick, but I can't see any way of passing by reference except by passing a pointer. After all, if you want to write a value back to the original variable, you have got to know...