Index: kernel/generic/include/ipc/ipc.h
===================================================================
--- kernel/generic/include/ipc/ipc.h	(revision 088ab052fad36572bd8f6da3b8bd3a6a8772c4a8)
+++ kernel/generic/include/ipc/ipc.h	(revision 645d9ed2a676dc71859db456dc0f1b504767fcea)
@@ -261,4 +261,10 @@
 	unative_t args[IPC_CALL_LEN];
 	phone_t *phone;
+	/*
+	 * The forward operation can masquerade the caller phone. For those
+	 * cases, we must keep it aside so that the answer is processed
+	 * correctly.
+	 */
+	phone_t *caller_phone;
 } ipc_data_t;
 
Index: kernel/generic/src/ipc/ipc.c
===================================================================
--- kernel/generic/src/ipc/ipc.c	(revision 088ab052fad36572bd8f6da3b8bd3a6a8772c4a8)
+++ kernel/generic/src/ipc/ipc.c	(revision 645d9ed2a676dc71859db456dc0f1b504767fcea)
@@ -348,6 +348,9 @@
 	spinlock_unlock(&oldbox->lock);
 
-	if (mode & IPC_FF_ROUTE_FROM_ME)
+	if (mode & IPC_FF_ROUTE_FROM_ME) {
+		if (!call->data.caller_phone)
+			call->data.caller_phone = call->data.phone;
 		call->data.phone = newphone;
+	}
 
 	return ipc_call(newphone, call);
@@ -393,5 +396,8 @@
 		request = list_get_instance(box->answers.next, call_t, link);
 		list_remove(&request->link);
-		atomic_dec(&request->data.phone->active_calls);
+		if (request->data.caller_phone)
+			atomic_dec(&request->data.caller_phone->active_calls);
+		else
+			atomic_dec(&request->data.phone->active_calls);
 	} else if (!list_empty(&box->calls)) {
 		/* Handle requests */
Index: kernel/generic/src/ipc/ipcrsc.c
===================================================================
--- kernel/generic/src/ipc/ipcrsc.c	(revision 088ab052fad36572bd8f6da3b8bd3a6a8772c4a8)
+++ kernel/generic/src/ipc/ipcrsc.c	(revision 645d9ed2a676dc71859db456dc0f1b504767fcea)
@@ -171,5 +171,4 @@
 
 	spinlock_lock(&TASK->lock);
-	
 	for (i = 0; i < IPC_MAX_PHONES; i++) {
 		if (TASK->phones[i].state == IPC_PHONE_HUNGUP &&
@@ -184,6 +183,7 @@
 	spinlock_unlock(&TASK->lock);
 
-	if (i >= IPC_MAX_PHONES)
+	if (i == IPC_MAX_PHONES)
 		return -1;
+
 	return i;
 }
Index: kernel/generic/src/main/kinit.c
===================================================================
--- kernel/generic/src/main/kinit.c	(revision 088ab052fad36572bd8f6da3b8bd3a6a8772c4a8)
+++ kernel/generic/src/main/kinit.c	(revision 645d9ed2a676dc71859db456dc0f1b504767fcea)
@@ -178,5 +178,4 @@
 			cap_set(programs[i].task, CAP_CAP | CAP_MEM_MANAGER |
 			    CAP_IO_MANAGER | CAP_PREEMPT_CONTROL | CAP_IRQ_REG);
-
 			
 			if (!ipc_phone_0)