Index: abi/include/abi/ipc/methods.h
===================================================================
--- abi/include/abi/ipc/methods.h	(revision f67d8ee72bcaaf0db7d633578c4b36ddff968098)
+++ abi/include/abi/ipc/methods.h	(revision f2c8f5588f9138d61d6ad09bef025846097bff23)
@@ -121,15 +121,21 @@
 	IPC_M_PAGE_IN,
 
-	/** Receive as_area over IPC.
-	 *
-	 * - ARG1 - destination as_area size
-	 * - ARG2 - user defined argument
-	 *
-	 * on answer, the recipient must set:
-	 *
-	 * - ARG1 - source as_area base address
-	 * - ARG2 - flags that will be used for sharing
-	 * - ARG3 - dst as_area lower bound
-	 * - ARG4 - dst as_area base address (filled automatically by kernel)
+	/** Receive an address space area over IPC.
+	 *
+	 * Sender:
+	 *  - uspace: arg1 .. address space area size
+	 *            arg2 .. sender's address space area starting address
+	 *                    lower bound
+	 *            arg3 .. <custom>
+	 *            arg4 .. <unused>
+	 *            arg5 .. <unused>
+	 *
+	 * Recipient:
+	 *  - uspace: arg1 .. recipient's address space area starting address
+	 *            arg2 .. shared address space areas sharing flags
+	 *            arg3 .. <unused>
+	 *            arg4 .. <unused>
+	 *  - kernel: arg5 .. new sender's address space area starting address
+	 *
 	 */
 	IPC_M_SHARE_IN,
Index: kernel/generic/src/ipc/ops/sharein.c
===================================================================
--- kernel/generic/src/ipc/ops/sharein.c	(revision f67d8ee72bcaaf0db7d633578c4b36ddff968098)
+++ kernel/generic/src/ipc/ops/sharein.c	(revision f2c8f5588f9138d61d6ad09bef025846097bff23)
@@ -51,6 +51,6 @@
 		errno_t rc = as_area_share(AS, IPC_GET_ARG1(answer->data),
 		    IPC_GET_ARG1(*olddata), as, IPC_GET_ARG2(answer->data),
-		    &dst_base, IPC_GET_ARG3(answer->data));
-		IPC_SET_ARG4(answer->data, dst_base);
+		    &dst_base, IPC_GET_ARG2(*olddata));
+		IPC_SET_ARG5(answer->data, dst_base);
 		IPC_SET_RETVAL(answer->data, rc);
 	}
Index: uspace/lib/c/generic/async/client.c
===================================================================
--- uspace/lib/c/generic/async/client.c	(revision f67d8ee72bcaaf0db7d633578c4b36ddff968098)
+++ uspace/lib/c/generic/async/client.c	(revision f2c8f5588f9138d61d6ad09bef025846097bff23)
@@ -937,6 +937,7 @@
 	sysarg_t _flags = 0;
 	sysarg_t _dst = (sysarg_t) -1;
-	errno_t res = async_req_2_4(exch, IPC_M_SHARE_IN, (sysarg_t) size,
-	    arg, NULL, &_flags, NULL, &_dst);
+	errno_t res = async_req_3_5(exch, IPC_M_SHARE_IN, (sysarg_t) size,
+	    (sysarg_t) __progsymbols.end, arg, NULL, &_flags, NULL, NULL,
+	    &_dst);
 
 	if (flags)
Index: uspace/lib/c/generic/async/server.c
===================================================================
--- uspace/lib/c/generic/async/server.c	(revision f67d8ee72bcaaf0db7d633578c4b36ddff968098)
+++ uspace/lib/c/generic/async/server.c	(revision f2c8f5588f9138d61d6ad09bef025846097bff23)
@@ -1228,7 +1228,5 @@
 	assert(call);
 
-	// FIXME: The source has no business deciding destination address.
-	return ipc_answer_3(call->cap_handle, EOK, (sysarg_t) src, (sysarg_t) flags,
-	    (sysarg_t) __progsymbols.end);
+	return ipc_answer_2(call->cap_handle, EOK, (sysarg_t) src, (sysarg_t) flags);
 }