Index: kernel/generic/src/ipc/ipc.c
===================================================================
--- kernel/generic/src/ipc/ipc.c	(revision 0f4f1b286ec18fe5bc220bbc629fc26b6813d889)
+++ kernel/generic/src/ipc/ipc.c	(revision 5f3188b820d64bcf193dac312a8069c4e69233ee)
@@ -967,12 +967,7 @@
 void ipc_print_task(task_id_t taskid)
 {
-	irq_spinlock_lock(&tasks_lock, true);
 	task_t *task = task_find_by_id(taskid);
-	if (!task) {
-		irq_spinlock_unlock(&tasks_lock, true);
+	if (!task)
 		return;
-	}
-	task_hold(task);
-	irq_spinlock_unlock(&tasks_lock, true);
 
 	printf("[phone cap] [calls] [state\n");
Index: kernel/generic/src/ipc/kbox.c
===================================================================
--- kernel/generic/src/ipc/kbox.c	(revision 0f4f1b286ec18fe5bc220bbc629fc26b6813d889)
+++ kernel/generic/src/ipc/kbox.c	(revision 5f3188b820d64bcf193dac312a8069c4e69233ee)
@@ -200,9 +200,4 @@
 /** Connect phone to a task kernel-box specified by id.
  *
- * Note that this is not completely atomic. For optimisation reasons, the task
- * might start cleaning up kbox after the phone has been connected and before
- * a kbox thread has been created. This must be taken into account in the
- * cleanup code.
- *
  * @param[out] out_phone  Phone capability handle on success.
  * @return Error code.
@@ -211,26 +206,13 @@
 errno_t ipc_connect_kbox(task_id_t taskid, cap_phone_handle_t *out_phone)
 {
-	irq_spinlock_lock(&tasks_lock, true);
-
 	task_t *task = task_find_by_id(taskid);
-	if (task == NULL) {
-		irq_spinlock_unlock(&tasks_lock, true);
+	if (!task)
 		return ENOENT;
-	}
-
-	atomic_inc(&task->refcount);
-
-	irq_spinlock_unlock(&tasks_lock, true);
 
 	mutex_lock(&task->kb.cleanup_lock);
-
-	if (atomic_predec(&task->refcount) == 0) {
-		mutex_unlock(&task->kb.cleanup_lock);
-		task_destroy(task);
-		return ENOENT;
-	}
 
 	if (task->kb.finished) {
 		mutex_unlock(&task->kb.cleanup_lock);
+		task_release(task);
 		return EINVAL;
 	}
@@ -243,4 +225,5 @@
 		if (!kb_thread) {
 			mutex_unlock(&task->kb.cleanup_lock);
+			task_release(task);
 			return ENOMEM;
 		}
@@ -255,4 +238,5 @@
 	if (rc != EOK) {
 		mutex_unlock(&task->kb.cleanup_lock);
+		task_release(task);
 		return rc;
 	}
@@ -265,4 +249,5 @@
 
 	mutex_unlock(&task->kb.cleanup_lock);
+	task_release(task);
 	*out_phone = phone_handle;
 	return EOK;