Index: kernel/generic/src/ipc/ipc.c
===================================================================
--- kernel/generic/src/ipc/ipc.c	(revision 30c27e95e487a311a88c5e35518a4cd018b0ed7f)
+++ kernel/generic/src/ipc/ipc.c	(revision fa32c9fed494a266a88de2f081478dff9fe4f31f)
@@ -743,5 +743,5 @@
 	all_clean = true;
 	for_each_cap_current(cap, CAP_TYPE_PHONE) {
-		phone_t *phone = &cap->phone;
+		phone_t *phone = (phone_t *) cap->kobject;
 
 		mutex_lock(&phone->lock);
@@ -820,5 +820,5 @@
 	/* Disconnect all our phones ('ipc_phone_hangup') */
 	for_each_cap_current(cap, CAP_TYPE_PHONE) {
-		phone_t *phone = &cap->phone;
+		phone_t *phone = (phone_t *) cap->kobject;
 		ipc_phone_hangup(phone);
 	}
@@ -913,5 +913,5 @@
 	
 	for_each_cap(task, cap, CAP_TYPE_PHONE) {
-		phone_t *phone = &cap->phone;
+		phone_t *phone = (phone_t *) cap->kobject;
 	
 		if (SYNCH_FAILED(mutex_trylock(&phone->lock))) {
Index: kernel/generic/src/ipc/ipcrsc.c
===================================================================
--- kernel/generic/src/ipc/ipcrsc.c	(revision 30c27e95e487a311a88c5e35518a4cd018b0ed7f)
+++ kernel/generic/src/ipc/ipcrsc.c	(revision fa32c9fed494a266a88de2f081478dff9fe4f31f)
@@ -135,4 +135,5 @@
 #include <abi/errno.h>
 #include <cap/cap.h>
+#include <mm/slab.h>
 
 /** Find call_t * in call table according to callid.
@@ -178,5 +179,5 @@
 		return NULL;
 	
-	return &cap->phone;
+	return (phone_t *) cap->kobject;
 }
 
@@ -190,6 +191,8 @@
 	assert(cap->type == CAP_TYPE_PHONE);
 
-	return (cap->phone.state == IPC_PHONE_HUNGUP) &&
-	    (atomic_get(&cap->phone.active_calls) == 0);
+	phone_t *phone = (phone_t *) cap->kobject;
+
+	return (phone->state == IPC_PHONE_HUNGUP) &&
+	    (atomic_get(&phone->active_calls) == 0);
 }
 
@@ -205,10 +208,18 @@
 	int handle = cap_alloc(task);
 	if (handle >= 0) {
+		phone_t *phone = malloc(sizeof(phone_t), FRAME_ATOMIC);
+		if (!phone) {
+			cap_free(TASK, handle);
+			return ENOMEM;
+		}
+		
+		ipc_phone_init(phone, task);
+		phone->state = IPC_PHONE_CONNECTING;
+		
 		irq_spinlock_lock(&task->lock, true);
 		cap_t *cap = cap_get(task, handle, CAP_TYPE_ALLOCATED);
-		ipc_phone_init(&cap->phone, task);
 		cap->type = CAP_TYPE_PHONE;
+		cap->kobject = (void *) phone;
 		cap->can_reclaim = phone_can_reclaim;
-		cap->phone.state = IPC_PHONE_CONNECTING;
 		irq_spinlock_unlock(&task->lock, true);
 	}
@@ -226,9 +237,16 @@
 void phone_dealloc(int handle)
 {
-	phone_t *phone = phone_get_current(handle);
+	irq_spinlock_lock(&TASK->lock, true);
+	cap_t *cap = cap_get_current(handle, CAP_TYPE_PHONE);
+	assert(cap);
+	cap->type = CAP_TYPE_ALLOCATED;
+	irq_spinlock_unlock(&TASK->lock, true);
+	
+	phone_t *phone = (phone_t *) cap->kobject;
 	
 	assert(phone);
 	assert(phone->state == IPC_PHONE_CONNECTING);
-
+	
+	free(phone);
 	cap_free(TASK, handle);
 }
Index: kernel/generic/src/ipc/irq.c
===================================================================
--- kernel/generic/src/ipc/irq.c	(revision 30c27e95e487a311a88c5e35518a4cd018b0ed7f)
+++ kernel/generic/src/ipc/irq.c	(revision fa32c9fed494a266a88de2f081478dff9fe4f31f)
@@ -307,8 +307,14 @@
 	if (handle < 0)
 		return handle;
+	
+	irq_t *irq = (irq_t *) malloc(sizeof(irq_t), FRAME_ATOMIC);
+	if (!irq) {
+		cap_free(TASK, handle);
+		return ENOMEM;
+	}
+	
 	cap_t *cap = cap_get_current(handle, CAP_TYPE_ALLOCATED);
 	assert(cap);
 	
-	irq_t *irq = &cap->irq;
 	irq_initialize(irq);
 	irq->inr = inr;
@@ -321,4 +327,6 @@
 	irq->notif_cfg.counter = 0;
 	
+	cap->kobject = (void *) irq;
+	
 	/*
 	 * Insert the IRQ structure into the uspace IRQ hash table and retype
@@ -359,5 +367,5 @@
 	irq_spinlock_unlock(&TASK->lock, true);
 	
-	irq_t *irq = &cap->irq;
+	irq_t *irq = (irq_t *) cap->kobject;
 	
 	irq_spinlock_lock(&irq_uspace_hash_table_lock, true);
@@ -376,4 +384,5 @@
 	
 	/* Free up the IRQ capability and the underlying kernel object. */
+	free(cap->kobject);
 	cap_free(TASK, handle);