Index: kernel/generic/src/ipc/kbox.c
===================================================================
--- kernel/generic/src/ipc/kbox.c	(revision 9233e9d118684a5593c031918cef402e75d25718)
+++ kernel/generic/src/ipc/kbox.c	(revision 569a51acd0cd10a573e65d239ca788a66e80c2db)
@@ -206,8 +206,9 @@
  * cleanup code.
  *
- * @return Phone capability handle on success, or negative error code.
- *
- */
-int ipc_connect_kbox(task_id_t taskid)
+ * @param[out] out_phone  Phone capability handle on success.
+ * @return Error code.
+ *
+ */
+int ipc_connect_kbox(task_id_t taskid, cap_handle_t *out_phone)
 {
 	irq_spinlock_lock(&tasks_lock, true);
@@ -250,5 +251,6 @@
 	if (task->kb.thread != NULL) {
 		mutex_unlock(&task->kb.cleanup_lock);
-		return phone_handle;
+		*out_phone = phone_handle;
+		return EOK;
 	}
 	
@@ -257,4 +259,5 @@
 	    THREAD_FLAG_NONE, "kbox");
 	if (!kb_thread) {
+		// FIXME: Shouldn't we clean up phone_handle?
 		mutex_unlock(&task->kb.cleanup_lock);
 		return ENOMEM;
@@ -266,5 +269,6 @@
 	mutex_unlock(&task->kb.cleanup_lock);
 	
-	return phone_handle;
+	*out_phone = phone_handle;
+	return EOK;
 }
 
Index: kernel/generic/src/ipc/sysipc.c
===================================================================
--- kernel/generic/src/ipc/sysipc.c	(revision 9233e9d118684a5593c031918cef402e75d25718)
+++ kernel/generic/src/ipc/sysipc.c	(revision 569a51acd0cd10a573e65d239ca788a66e80c2db)
@@ -901,16 +901,22 @@
 /** Syscall connect to a task by ID (32 bits)
  *
- * @return Phone id on success, or negative error code.
- *
- */
-sysarg_t sys_ipc_connect_kbox(sysarg64_t *uspace_taskid)
+ * @return Error code.
+ *
+ */
+sysarg_t sys_ipc_connect_kbox(sysarg64_t *uspace_taskid, cap_handle_t *uspace_phone)
 {
 #ifdef CONFIG_UDEBUG
 	sysarg64_t taskid;
+	cap_handle_t phone;
 	int rc = copy_from_uspace(&taskid, uspace_taskid, sizeof(sysarg64_t));
-	if (rc != 0)
-		return (sysarg_t) rc;
-	
-	return ipc_connect_kbox((task_id_t) taskid);
+	if (rc == EOK) {
+		rc = ipc_connect_kbox((task_id_t) taskid, &phone);
+	}
+	if (rc == EOK) {
+		rc = copy_to_uspace(uspace_phone, &phone, sizeof(cap_handle_t));
+		// FIXME: Clean up phone on failure.
+	}
+	
+	return (sysarg_t) rc;
 #else
 	return (sysarg_t) ENOTSUP;
@@ -924,11 +930,16 @@
 /** Syscall connect to a task by ID (64 bits)
  *
- * @return Phone id on success, or negative error code.
- *
- */
-sysarg_t sys_ipc_connect_kbox(sysarg_t taskid)
+ * @return Error code.
+ *
+ */
+sysarg_t sys_ipc_connect_kbox(sysarg_t taskid, cap_handle_t *uspace_phone)
 {
 #ifdef CONFIG_UDEBUG
-	return ipc_connect_kbox((task_id_t) taskid);
+	cap_handle_t phone;
+	int rc = ipc_connect_kbox((task_id_t) taskid, &phone);
+	if (rc == EOK) {
+		rc = copy_to_uspace(uspace_phone, &phone, sizeof(cap_handle_t));
+	}
+	return (sysarg_t) rc;
 #else
 	return (sysarg_t) ENOTSUP;