Index: kernel/generic/include/ipc/ipc.h
===================================================================
--- kernel/generic/include/ipc/ipc.h	(revision c0ea73977181a878e909e0c19075283d21709426)
+++ kernel/generic/include/ipc/ipc.h	(revision b9a272563e38eea07dab1ea8d97ee76936365f1a)
@@ -47,4 +47,5 @@
 struct answerbox;
 struct task;
+struct call;
 
 typedef enum {
@@ -67,4 +68,6 @@
 	struct task *caller;
 	struct answerbox *callee;
+	/* A call prepared for hangup ahead of time, so that it cannot fail. */
+	struct call *hangup_call;
 	ipc_phone_state_t state;
 	atomic_t active_calls;
@@ -172,7 +175,4 @@
 
 extern call_t *ipc_call_alloc(unsigned int);
-extern void ipc_call_free(call_t *);
-extern void ipc_call_hold(call_t *);
-extern void ipc_call_release(call_t *);
 
 extern errno_t ipc_call_sync(phone_t *, call_t *);
Index: kernel/generic/src/ipc/ipc.c
===================================================================
--- kernel/generic/src/ipc/ipc.c	(revision c0ea73977181a878e909e0c19075283d21709426)
+++ kernel/generic/src/ipc/ipc.c	(revision b9a272563e38eea07dab1ea8d97ee76936365f1a)
@@ -116,4 +116,6 @@
 call_t *ipc_call_alloc(unsigned int flags)
 {
+	// TODO: Allocate call and kobject in single allocation
+
 	call_t *call = slab_alloc(call_cache, flags);
 	if (!call)
@@ -483,5 +485,8 @@
 		kobject_put(phone->kobject);
 
-		call_t *call = ipc_call_alloc(0);
+		call_t *call = phone->hangup_call;
+		phone->hangup_call = NULL;
+		assert(call);
+
 		IPC_SET_IMETHOD(call->data, IPC_M_PHONE_HUNGUP);
 		call->request_method = IPC_M_PHONE_HUNGUP;
@@ -685,5 +690,8 @@
 			 * to exist as soon as we release it.
 			 */
-			call_t *call = ipc_call_alloc(0);
+			call_t *call = phone->hangup_call;
+			phone->hangup_call = NULL;
+			assert(call);
+
 			IPC_SET_IMETHOD(call->data, IPC_M_PHONE_HUNGUP);
 			call->request_method = IPC_M_PHONE_HUNGUP;
Index: kernel/generic/src/ipc/ipcrsc.c
===================================================================
--- kernel/generic/src/ipc/ipcrsc.c	(revision c0ea73977181a878e909e0c19075283d21709426)
+++ kernel/generic/src/ipc/ipcrsc.c	(revision b9a272563e38eea07dab1ea8d97ee76936365f1a)
@@ -46,4 +46,6 @@
 {
 	phone_t *phone = (phone_t *) arg;
+	if (phone->hangup_call)
+		kobject_put(phone->hangup_call->kobject);
 	slab_free(phone_cache, phone);
 }
@@ -79,7 +81,15 @@
 			return ENOMEM;
 		}
+		call_t *hcall = ipc_call_alloc(FRAME_ATOMIC);
+		if (!hcall) {
+			cap_free(TASK, handle);
+			slab_free(phone_cache, phone);
+			free(kobj);
+			return ENOMEM;
+		}
 
 		ipc_phone_init(phone, task);
 		phone->state = IPC_PHONE_CONNECTING;
+		phone->hangup_call = hcall;
 
 		kobject_initialize(kobj, KOBJECT_TYPE_PHONE, phone,