x86 registers in real mode include the normal set of processor registers, and an additional set of segment registers, all of which are 16 bits long. To extend the address space beyond 64kb the segment registers are offset 4 bits from the other address registers, and the final address is calculated by adding the address register (the Stack Pointer in your case) to the segment register (SS for your question)
Thus you get:
SS = 9000 ; offset 4 bits
SP = FB00
=====
9FB00 ; Final address in actual memory space.
This is extended considerably once you leave real mode as 32-bit registers become available.