Index: src/kern/factory.cpp
===================================================================
--- src/kern/factory.cpp	(revision 38)
+++ src/kern/factory.cpp	(working copy)
@@ -198,7 +198,7 @@
                  Utcb const *utcb, Utcb *)
 {
   register Context *const c_thread = ::current();
-  register Space *const c_space = c_thread->space();
+  register Task *const c_space = static_cast<Task*>(c_thread->space());
   register Obj_space *const o_space = c_space->obj_space();
 
   if (EXPECT_FALSE(f->tag().proto() != L4_msg_tag::Label_factory))
@@ -230,6 +230,13 @@
 
   Kobject_iface *new_o;
 
+  Lock_guard<typeof(c_space->existence_lock)> space_lock_guard;
+
+  if (!space_lock_guard.try_lock(&c_space->existence_lock))
+    return commit_error(utcb, L4_error(L4_error::Overflow, L4_error::Rcv));
+
+  Lock_guard<Cpu_lock, Lock_guard_inverse_policy> cpu_lock_guard(&cpu_lock);
+
   switch ((long)utcb->values[0])
     {
     case 0:  // new IPC Gate
Index: src/kern/thread-ipc.cpp
===================================================================
--- src/kern/thread-ipc.cpp	(revision 38)
+++ src/kern/thread-ipc.cpp	(working copy)
@@ -861,6 +861,7 @@
                            unsigned char rights)
 {
   // LOG_MSG_3VAL(current(), "map bd=", rcv_utcb->buf_desc.raw(), 0, 0);
+  Task *const rcv_t = nonull_static_cast<Task*>(rcv->space());
   L4_buf_iter mem_buffer(rcv_utcb, rcv_utcb->buf_desc.mem());
   L4_buf_iter io_buffer(rcv_utcb, rcv_utcb->buf_desc.io());
   L4_buf_iter obj_buffer(rcv_utcb, rcv_utcb->buf_desc.obj());
@@ -936,11 +937,21 @@
 	      // diminish when sending via restricted ipc gates
 	      if (sfp.type() == L4_fpage::Obj)
 		sfp.mask_rights(L4_fpage::Rights(rights | L4_fpage::RX));
-	      cpu_lock.clear();
-	      L4_error err = fpage_map(snd->space(), sfp,
-		  rcv->space(), L4_fpage(buf->d), item->b, &rl);
-	      cpu_lock.lock();
 
+	      L4_error err;
+                {
+                  Lock_guard<typeof(rcv_t->existence_lock)> sp_lock;
+                  if (!sp_lock.try_lock(&rcv_t->existence_lock))
+                    {
+                      snd->set_ipc_error(L4_error::Overflow, rcv);
+                      return false;
+                    }
+
+                  Lock_guard<Cpu_lock, Lock_guard_inverse_policy> c_lock(&cpu_lock);
+                  err = fpage_map(snd->space(), sfp,
+                                  rcv->space(), L4_fpage(buf->d), item->b, &rl);
+                }
+
 	      if (EXPECT_FALSE(!err.ok()))
 		{
 		  snd->set_ipc_error(err, rcv);
Index: src/lib/libk/lock_guard.cpp
===================================================================
--- src/lib/libk/lock_guard.cpp	(revision 38)
+++ src/lib/libk/lock_guard.cpp	(working copy)
@@ -1,13 +1,44 @@
 INTERFACE:
 
-// 
+//
+// Regular lock-guard policy, lock on ctor, unlock/reset in dtor
+//
+template< typename LOCK >
+struct Lock_guard_regular_policy
+{
+  typedef typename LOCK::Status Status;
+  static Status test_and_set(LOCK *l) { return l->test_and_set(); }
+  static void set(LOCK *l, Status s) { l->set(s); }
+};
+
+//
+// Inverse lock-guard policy, unlock in ctor, lock in dtor
+// NOTE: this is applicable only to some locks (e.g., the cpu lock)
+//
+template<typename LOCK>
+struct Lock_guard_inverse_policy : private LOCK
+{
+  typedef typename LOCK::Status Status;
+  static Status test_and_set(LOCK *l) { l->clear(); return LOCK::Locked; }
+  static void set(LOCK *l, Status s) { l->set(s); }
+};
+
+
+//
 // Lock_guard: a guard object using a lock such as helping_lock_t
-// 
-template<typename LOCK>
+//
+template<
+  typename LOCK,
+  template< typename L > class POLICY = Lock_guard_regular_policy >
 class Lock_guard
 {
-  LOCK *_lock;
-  typename LOCK::Status _state;
+  template<typename T> struct Ptr_t { typedef T Type; };
+  template<typename T> struct Ptr_t<T*> { typedef T Type; };
+  typedef typename Ptr_t<LOCK>::Type Lock;
+  typedef POLICY<Lock> Policy;
+
+  Lock *_lock;
+  typename Policy::Status _state;
 };
 
 template< typename LOCK>
@@ -19,43 +50,43 @@
 
 IMPLEMENTATION:
 
-PUBLIC template<typename LOCK>
+PUBLIC template<typename LOCK, template< typename L > class POLICY>
 inline
-Lock_guard<LOCK>::Lock_guard()
+Lock_guard<LOCK, POLICY>::Lock_guard()
   : _lock(0)
 #ifndef NDEBUG
-    , _state(LOCK::Invalid) // silence GCC warning
+    , _state(Lock::Invalid) // silence GCC warning
 #endif
 {}
 
-PUBLIC template<typename LOCK>
+PUBLIC template<typename LOCK, template< typename L > class POLICY>
 inline
-Lock_guard<LOCK>::Lock_guard(LOCK *l)
+Lock_guard<LOCK, POLICY>::Lock_guard(Lock *l)
   : _lock(l)
 {
-  _state = _lock->test_and_set();
+  _state = Policy::test_and_set(_lock);
 }
 
-PUBLIC template<typename LOCK>
+PUBLIC template<typename LOCK, template< typename L > class POLICY>
 inline
 void
-Lock_guard<LOCK>::lock(LOCK *l)
+Lock_guard<LOCK, POLICY>::lock(Lock *l)
 {
   _lock = l;
-  _state = l->test_and_set();
+  _state = Policy::test_and_set(l);
 }
 
-PUBLIC template<typename LOCK>
+PUBLIC template<typename LOCK, template< typename L > class POLICY>
 inline
 bool
-Lock_guard<LOCK>::try_lock(LOCK *l)
+Lock_guard<LOCK, POLICY>::try_lock(Lock *l)
 {
-  _state = l->test_and_set();
+  _state = Policy::test_and_set(l);
   switch (_state)
     {
-    case LOCK::Locked:
+    case Lock::Locked:
       return true;
-    case LOCK::Not_locked:
+    case Lock::Not_locked:
       _lock = l;			// Was not locked -- unlock.
       return true;
     default:
@@ -63,30 +94,30 @@
     }
 }
 
-PUBLIC template<typename LOCK>
+PUBLIC template<typename LOCK, template< typename L > class POLICY>
 inline
 void
-Lock_guard<LOCK>::release()
+Lock_guard<LOCK, POLICY>::release()
 {
   if (_lock)
     {
-      _lock->set(_state);
+      Policy::set(_lock, _state);
       _lock = 0;
     }
 }
 
-PUBLIC template<typename LOCK>
+PUBLIC template<typename LOCK, template< typename L > class POLICY>
 inline
-Lock_guard<LOCK>::~Lock_guard()
+Lock_guard<LOCK, POLICY>::~Lock_guard()
 {
   if (_lock)
-    _lock->set(_state);
+    Policy::set(_lock, _state);
 }
 
-PUBLIC template<typename LOCK>
+PUBLIC template<typename LOCK, template< typename L > class POLICY>
 inline
 bool
-Lock_guard<LOCK>::was_set(void)
+Lock_guard<LOCK, POLICY>::was_set(void)
 {
   return _state; //!_lock;
 }
