Index: kernel/generic/src/ipc/ipc.c
===================================================================
--- kernel/generic/src/ipc/ipc.c	(revision 87e7a18777aa6dd4e6f3ddc275b0df3ae29cbe46)
+++ kernel/generic/src/ipc/ipc.c	(revision 34316d448397db1670e737b6b8ba88f891025f96)
@@ -753,18 +753,4 @@
 }
 
-/** Wait for all answers to asynchronous calls to arrive. */
-static void ipc_wait_for_all_answered_calls(void)
-{
-	while (atomic_get(&TASK->answerbox.active_calls) != 0) {
-		call_t *call = ipc_wait_for_call(&TASK->answerbox,
-		    SYNCH_NO_TIMEOUT, SYNCH_FLAGS_NONE);
-		assert(call->flags & (IPC_CALL_ANSWERED | IPC_CALL_NOTIF));
-
-		SYSIPC_OP(answer_process, call);
-
-		kobject_put(call->kobject);
-	}
-}
-
 static bool phone_cap_cleanup_cb(cap_t *cap, void *arg)
 {
@@ -775,4 +761,26 @@
 	cap_free(cap->task, cap->handle);
 	return true;
+}
+
+/** Wait for all answers to asynchronous calls to arrive. */
+static void ipc_wait_for_all_answered_calls(void)
+{
+	while (atomic_get(&TASK->answerbox.active_calls) != 0) {
+		call_t *call = ipc_wait_for_call(&TASK->answerbox,
+		    SYNCH_NO_TIMEOUT, SYNCH_FLAGS_NONE);
+		assert(call->flags & (IPC_CALL_ANSWERED | IPC_CALL_NOTIF));
+
+		SYSIPC_OP(answer_process, call);
+
+		kobject_put(call->kobject);
+
+		/*
+		 * Now there may be some new phones and new hangup calls to
+		 * immediately forget.
+		 */
+		caps_apply_to_kobject_type(TASK, KOBJECT_TYPE_PHONE,
+		    phone_cap_cleanup_cb, NULL);
+		ipc_forget_all_active_calls();
+	}
 }
 
@@ -814,9 +822,9 @@
 	irq_spinlock_unlock(&TASK->answerbox.lock, true);
 
-	/* Disconnect all our phones ('ipc_phone_hangup') */
+	/* Hangup all phones and destroy all phone capabilities */
 	caps_apply_to_kobject_type(TASK, KOBJECT_TYPE_PHONE,
 	    phone_cap_cleanup_cb, NULL);
 
-	/* Unsubscribe from any event notifications. */
+	/* Unsubscribe from any event notifications */
 	event_cleanup_answerbox(&TASK->answerbox);
 
@@ -844,4 +852,6 @@
 	ipc_forget_all_active_calls();
 	ipc_wait_for_all_answered_calls();
+
+	assert(atomic_get(&TASK->answerbox.active_calls) == 0);
 }