diff --git a/kern/src/pd.cc b/kern/src/pd.cc
index a7d620b..d56c52e 100644
--- a/kern/src/pd.cc
+++ b/kern/src/pd.cc
@@ -39,18 +39,30 @@ void Pd::del_cap(Pd *snd, mword snd_sel, mword rcv_sel)
            snd_sel,
            rcv_sel);
 
-    // TODO find mdb node
-    // TODO check if rcv_sel is free
-    // TODO create new mdb node
-    // TODO insert and update
-    // TODO remember delegation
+    if (rcv_sel >= MAX_CAPS)
+        return;
+    Mdb *mdb = snd->list_lookup(snd_sel);
+    if (!mdb)
+        return;
+    if (list_lookup(rcv_sel))
+        return;
+
+    Mdb *node = new Mdb(this, rcv_sel, mdb->kobj);
+    list_insert(node);
+    mdb->add_del(node);
+
+    update(node);
 }
 
 void Pd::revoke_rec(Mdb *node)
 {
-    // TODO remove from list
-    // TODO remove from table
-    // TODO remove childs
+    node->space->list_remove(node);
+    node->space->table_remove(node->selector);
+
+    if (node->first_del)
+        revoke_rec(node->first_del);
+    if (node->next_del)
+        revoke_rec(node->next_del);
 }
 
 void Pd::revoke(mword sel)
diff --git a/user/src/user.cc b/user/src/user.cc
index 44791c0..099d359 100644
--- a/user/src/user.cc
+++ b/user/src/user.cc
@@ -136,6 +136,7 @@ void portal()
     words[0]              = INV_CAP;
     words[1]              = INV_CAP;
     words[3]             += words[4];
+    sys_yield();
 }
 
 extern "C" void reply_tramp();
@@ -165,6 +166,8 @@ void main_func()
         sys_create_ec(ROOT_PD_SEL, 0, local_ec_stack(stack + STACK_WORDS * 2), UTCB_RECEIVER);
     pt_sel = sys_create_pt(portal, rcvec_sel);
 
-    while (1)
+    while (1) {
         sys_yield();
+        sys_revoke(pt_sel);
+    }
 }