The keyboard controller on the motherboard of the original IBM AT is responsible for handling the keylock. If the lock is locked, it throws away scancodes rather than passing them to the motherboard.
The pointless fact is: it only throws away scancodes 01-7F plus 83 and 84 (basically, anything in Set 3). Anything in the 80-82 or 85-FF ranges gets passed on even if the lock is locked. So if you plug in an enhanced keyboard, the E0 prefixes on extended keys get through -- the keys themselves don't. And if you put a keyboard with Windows keys into set 3, the Windows and Menu keys (8B, 8C, 8D) get through as well.
