Index: kernel/generic/src/ipc/ops/concttome.c
===================================================================
--- kernel/generic/src/ipc/ops/concttome.c	(revision 26a6ed455c15df465e75a11c6b9f09082f8769f9)
+++ kernel/generic/src/ipc/ops/concttome.c	(revision bbf38adecf66dfb8e2a7b2049c43f217e6dba8c1)
@@ -43,5 +43,7 @@
 {
 	cap_handle_t phone_handle;
-	errno_t rc = phone_alloc(TASK, true, &phone_handle, NULL);
+	kobject_t *phone_obj;
+	errno_t rc = phone_alloc(TASK, false, &phone_handle, &phone_obj);
+	call->priv = (sysarg_t) phone_obj;
 	IPC_SET_ARG5(call->data, (rc == EOK) ? phone_handle : -1);
 	return 0;
@@ -51,7 +53,10 @@
 {
 	cap_handle_t phone_handle = (cap_handle_t) IPC_GET_ARG5(*olddata);
+	kobject_t *phone_obj = (kobject_t *) answer->priv;
 
-	if (phone_handle >= 0)
-		phone_dealloc(phone_handle);
+	if (phone_handle >= 0) {
+		kobject_put(phone_obj);
+		cap_free(TASK, phone_handle);
+	}
 
 	return EOK;
@@ -61,4 +66,5 @@
 {
 	cap_handle_t phone_handle = (cap_handle_t) IPC_GET_ARG5(*olddata);
+	kobject_t *phone_obj = (kobject_t *) answer->priv;
 
 	if (IPC_GET_RETVAL(answer->data) != EOK) {
@@ -66,12 +72,21 @@
 		answer_cleanup(answer, olddata);
 	} else if (phone_handle >= 0) {
-		/* The connection was accepted */
-		if (phone_connect(phone_handle, &answer->sender->answerbox)) {
+		/*
+		 * The connection was accepted
+		 * */
+
+		/*
+		 * We need to create another reference as the one we have now
+		 * will be consumed by ipc_phone_connect().
+		 */
+		kobject_add_ref(phone_obj);
+
+		if (ipc_phone_connect(phone_obj->phone,
+		    &answer->sender->answerbox)) {
+			/* Pass the reference to the capability */
+			cap_publish(TASK, phone_handle, phone_obj);
 			/* Set 'phone hash' as ARG5 of response */
-			kobject_t *phone_obj = kobject_get(TASK, phone_handle,
-			    KOBJECT_TYPE_PHONE);
 			IPC_SET_ARG5(answer->data,
 			    (sysarg_t) phone_obj->phone);
-			kobject_put(phone_obj);
 		} else {
 			/* The answerbox is shutting down. */