Well, Sice IDT dump shows that int1 & int3 handlers are in the ntoskrnl - but I think it's SI's code that really handles those ints. Maybe SI hooks itself inside windows handlers instead of just replacing IDT entries - I'm not that familiar with its internal working
[edit]
Just checked what's at address displayed by my dumper:
Code:
:bpx 8:b3fcd778
Breakpoints not allowed within SoftICE