Function call_deadline_into 

pub fn call_deadline_into(
    target: CapHandle,
    reply_grant: CapHandle,
    recv: CapHandle,
    request: &[u8],
    buf: &mut [u8],
    max_secs: u64,
) -> Result<Option<usize>, IpcError>

call, bounded, receiving into a caller-owned buffer.

The reason this exists as a SYSCALL rather than the hand-rolled send + recv_timeout_into it replaces: recv_timeout_into takes whatever is next on the endpoint. A service that serves clients on the same endpoint it awaits replies on would receive an unrelated CLIENT REQUEST, fail to match it, and drop it - losing the request and leaving the real reply to arrive later as an orphan that desynced every following exchange. Call never had that flaw (it dequeues the reply specifically), it just could not be bounded. Now it can.

Three cap slots pack into a0 at 8 bits each - a task holds at most 64 caps, so six bits suffice - because the ARM 32-bit ABI truncates each argument to one register and the plain call layout had no room left. Length and deadline share a2.

Ok(None) = the deadline passed with no reply.