Function recv_timeout_into 

pub fn recv_timeout_into(
    endpoint: CapHandle,
    buf: &mut [u8],
    timeout_cycles: u64,
) -> Result<Option<usize>, IpcError>

Receive into a buffer the CALLER owns, returning the byte count.

A Message carries a 4096-byte payload BY VALUE, so recv_timeout below costs EIGHT kilobytes of stack per call: one 4 KiB array to receive into, and another inside the Message it builds and returns. Every wrapper that forwards that Message pays 4 KiB again.

On fs that arithmetic is fatal rather than untidy. Its request path is several such calls deep, it runs on a 256 KiB stack, and adding one more level made it overflow at mount - a fault that took five wrong attempts to place because each one removed a single 4 KiB item without measuring the whole frame.

This is the shape the operation actually has, and the shape every real IPC API uses: the kernel copies into memory the caller already owns, and hands back a length. Nothing large is created and nothing large is moved. Ok(None) is the timeout, exactly as above.

Caps are NOT delivered here - the block and frame paths carry none, and a caller that needs one takes it with take_pending_cap regardless. A buffer API that silently dropped a capability would be a leak, so this one simply does not carry them.