Index: kernel/generic/src/ipc/sysipc.c
===================================================================
--- kernel/generic/src/ipc/sysipc.c	(revision b1696194837e19c7e4d446880d20ede25043bad4)
+++ kernel/generic/src/ipc/sysipc.c	(revision 2df21755623b239a0d57f0639a0bfcf636cd3d5b)
@@ -199,5 +199,5 @@
 			list_remove(&phone->link);
 			/* Drop callee->connected_phones reference */
-			kobject_put(phone->kobject);
+			kobject_put(&phone->kobject);
 			phone->state = IPC_PHONE_SLAMMED;
 			phone->label = 0;
@@ -273,11 +273,12 @@
 ipc_req_internal(cap_phone_handle_t handle, ipc_data_t *data, sysarg_t priv)
 {
-	kobject_t *kobj = kobject_get(TASK, handle, KOBJECT_TYPE_PHONE);
-	if (!kobj->phone)
+	phone_t *phone = phone_from_kobject(
+	    kobject_get(TASK, handle, KOBJECT_TYPE_PHONE));
+	if (!phone)
 		return ENOENT;
 
 	call_t *call = ipc_call_alloc();
 	if (!call) {
-		kobject_put(kobj);
+		kobject_put(&phone->kobject);
 		return ENOMEM;
 	}
@@ -286,5 +287,5 @@
 	memcpy(call->data.args, data->args, sizeof(data->args));
 
-	errno_t rc = request_preprocess(call, kobj->phone);
+	errno_t rc = request_preprocess(call, phone);
 	if (!rc) {
 #ifdef CONFIG_UDEBUG
@@ -292,10 +293,10 @@
 #endif
 
-		kobject_add_ref(call->kobject);
-		rc = ipc_call_sync(kobj->phone, call);
+		kobject_add_ref(&call->kobject);
+		rc = ipc_call_sync(phone, call);
 		spinlock_lock(&call->forget_lock);
 		bool forgotten = call->forget;
 		spinlock_unlock(&call->forget_lock);
-		kobject_put(call->kobject);
+		kobject_put(&call->kobject);
 
 #ifdef CONFIG_UDEBUG
@@ -312,5 +313,5 @@
 				 * deallocation.
 				 */
-				kobject_put(call->kobject);
+				kobject_put(&call->kobject);
 			} else {
 				/*
@@ -320,5 +321,5 @@
 				assert(rc == EINTR);
 			}
-			kobject_put(kobj);
+			kobject_put(&phone->kobject);
 			return rc;
 		}
@@ -329,6 +330,6 @@
 
 	memcpy(data->args, call->data.args, sizeof(data->args));
-	kobject_put(call->kobject);
-	kobject_put(kobj);
+	kobject_put(&call->kobject);
+	kobject_put(&phone->kobject);
 
 	return EOK;
@@ -370,10 +371,12 @@
     sysarg_t arg1, sysarg_t arg2, sysarg_t arg3, sysarg_t label)
 {
-	kobject_t *kobj = kobject_get(TASK, handle, KOBJECT_TYPE_PHONE);
-	if (!kobj)
+	phone_t *phone = phone_from_kobject(
+	    kobject_get(TASK, handle, KOBJECT_TYPE_PHONE));
+
+	if (!phone)
 		return ENOENT;
 
-	if (check_call_limit(kobj->phone)) {
-		kobject_put(kobj);
+	if (check_call_limit(phone)) {
+		kobject_put(&phone->kobject);
 		return ELIMIT;
 	}
@@ -381,5 +384,5 @@
 	call_t *call = ipc_call_alloc();
 	if (!call) {
-		kobject_put(kobj);
+		kobject_put(&phone->kobject);
 		return ENOMEM;
 	}
@@ -399,12 +402,12 @@
 	call->data.answer_label = label;
 
-	errno_t res = request_preprocess(call, kobj->phone);
+	errno_t res = request_preprocess(call, phone);
 
 	if (!res)
-		ipc_call(kobj->phone, call);
+		ipc_call(phone, call);
 	else
-		ipc_backsend_err(kobj->phone, call, res);
-
-	kobject_put(kobj);
+		ipc_backsend_err(phone, call, res);
+
+	kobject_put(&phone->kobject);
 	return EOK;
 }
@@ -422,10 +425,11 @@
     sysarg_t label)
 {
-	kobject_t *kobj = kobject_get(TASK, handle, KOBJECT_TYPE_PHONE);
-	if (!kobj)
+	phone_t *phone = phone_from_kobject(
+	    kobject_get(TASK, handle, KOBJECT_TYPE_PHONE));
+	if (!phone)
 		return ENOENT;
 
-	if (check_call_limit(kobj->phone)) {
-		kobject_put(kobj);
+	if (check_call_limit(phone)) {
+		kobject_put(&phone->kobject);
 		return ELIMIT;
 	}
@@ -433,5 +437,5 @@
 	call_t *call = ipc_call_alloc();
 	if (!call) {
-		kobject_put(kobj);
+		kobject_put(&phone->kobject);
 		return ENOMEM;
 	}
@@ -440,6 +444,6 @@
 	    sizeof(call->data.args));
 	if (rc != EOK) {
-		kobject_put(call->kobject);
-		kobject_put(kobj);
+		kobject_put(&call->kobject);
+		kobject_put(&phone->kobject);
 		return (sys_errno_t) rc;
 	}
@@ -448,12 +452,12 @@
 	call->data.answer_label = label;
 
-	errno_t res = request_preprocess(call, kobj->phone);
+	errno_t res = request_preprocess(call, phone);
 
 	if (!res)
-		ipc_call(kobj->phone, call);
+		ipc_call(phone, call);
 	else
-		ipc_backsend_err(kobj->phone, call, res);
-
-	kobject_put(kobj);
+		ipc_backsend_err(phone, call, res);
+
+	kobject_put(&phone->kobject);
 	return EOK;
 }
@@ -489,5 +493,5 @@
 		return ENOENT;
 
-	call_t *call = ckobj->call;
+	call_t *call = call_from_kobject(ckobj);
 
 	ipc_data_t old;
@@ -551,5 +555,5 @@
 	}
 
-	rc = ipc_forward(call, pkobj->phone, &TASK->answerbox, mode);
+	rc = ipc_forward(call, phone_from_kobject(pkobj), &TASK->answerbox, mode);
 	if (rc != EOK) {
 		after_forward = true;
@@ -659,5 +663,5 @@
 		return ENOENT;
 
-	call_t *call = kobj->call;
+	call_t *call = call_from_kobject(kobj);
 	assert(!(call->flags & IPC_CALL_ANSWERED));
 
@@ -706,5 +710,5 @@
 		return ENOENT;
 
-	call_t *call = kobj->call;
+	call_t *call = call_from_kobject(kobj);
 	assert(!(call->flags & IPC_CALL_ANSWERED));
 
@@ -751,5 +755,5 @@
 		return ENOENT;
 
-	errno_t rc = ipc_phone_hangup(kobj->phone);
+	errno_t rc = ipc_phone_hangup(phone_from_kobject(kobj));
 	kobject_put(kobj);
 	cap_free(TASK, handle);
@@ -797,5 +801,5 @@
 
 		STRUCT_TO_USPACE(calldata, &call->data);
-		kobject_put(call->kobject);
+		kobject_put(&call->kobject);
 
 		return EOK;
@@ -806,5 +810,5 @@
 
 		if (call->flags & IPC_CALL_DISCARD_ANSWER) {
-			kobject_put(call->kobject);
+			kobject_put(&call->kobject);
 			goto restart;
 		}
@@ -813,5 +817,5 @@
 
 		STRUCT_TO_USPACE(calldata, &call->data);
-		kobject_put(call->kobject);
+		kobject_put(&call->kobject);
 
 		return EOK;
@@ -836,6 +840,6 @@
 		goto error;
 
-	kobject_add_ref(call->kobject);
-	cap_publish(TASK, handle, call->kobject);
+	kobject_add_ref(&call->kobject);
+	cap_publish(TASK, handle, &call->kobject);
 	return EOK;