diff --git a/base-hw/src/core/kernel/core_interface.h b/base-hw/src/core/kernel/core_interface.h
index 026cd6f7ff..ff80019968 100644
--- a/base-hw/src/core/kernel/core_interface.h
+++ b/base-hw/src/core/kernel/core_interface.h
@@ -171,11 +171,10 @@ namespace Kernel
 	/**
 	 * Access plain member variables of a kernel thread-object
 	 *
-	 * \param thread_id     kernel name of the targeted thread
-	 * \param reads         amount of read operations
-	 * \param writes        amount of write operations
-	 * \param read_values   base of value buffer for read operations
-	 * \param write_values  base of value buffer for write operations
+	 * \param thread_id  kernel name of the targeted thread
+	 * \param reads      amount of read operations
+	 * \param writes     amount of write operations
+	 * \param values     base of the value buffer for all operations
 	 *
 	 * \return  amount of undone operations according to the execution order
 	 *
@@ -192,20 +191,22 @@ namespace Kernel
 	 *                  ...                   ...
 	 * (reads + writes - 1) * sizeof(addr_t): write register name #writes
 	 *
-	 * Expected structure at write_values:
+	 * Expected structure at values:
 	 *
-	 *                    0 * sizeof(addr_t): write value #1
+	 *                    0 * sizeof(addr_t): read destination #1
 	 *                  ...                   ...
-	 *         (writes - 1) * sizeof(addr_t): write value #writes
+	 *          (reads - 1) * sizeof(addr_t): read destination #reads
+	 *          (reads - 0) * sizeof(addr_t): write value #1
+	 *                  ...                   ...
+	 * (reads + writes - 1) * sizeof(addr_t): write value #writes
 	 */
 	inline unsigned access_thread_regs(unsigned const thread_id,
 	                                   unsigned const reads,
 	                                   unsigned const writes,
-	                                   addr_t * const read_values,
-	                                   addr_t * const write_values)
+	                                   addr_t * const values)
 	{
 		return call(call_id_access_thread_regs(), thread_id, reads, writes,
-		            (Call_arg)read_values, (Call_arg)write_values);
+		            (Call_arg)values);
 	}
 
 
diff --git a/base-hw/src/core/kernel/thread.cc b/base-hw/src/core/kernel/thread.cc
index b16b4ad880..2249386baf 100644
--- a/base-hw/src/core/kernel/thread.cc
+++ b/base-hw/src/core/kernel/thread.cc
@@ -571,21 +571,22 @@ void Thread::_call_access_thread_regs()
 	/* execute read operations */
 	addr_t * const utcb = (addr_t *)_utcb_phys->base();
 	addr_t * const read_ids = &utcb[0];
-	addr_t * const read_values = (addr_t *)user_arg_4();
+	addr_t * values = (addr_t *)user_arg_4();
 	for (unsigned i = 0; i < reads; i++) {
-		if (t->_read_reg(read_ids[i], read_values[i])) {
+		if (t->_read_reg(read_ids[i], *values)) {
 			user_arg_0(reads + writes - i);
 			return;
 		}
+		values++;
 	}
 	/* execute write operations */
 	addr_t * const write_ids = &utcb[reads];
-	addr_t * const write_values = (addr_t *)user_arg_5();
 	for (unsigned i = 0; i < writes; i++) {
-		if (t->_write_reg(write_ids[i], write_values[i])) {
+		if (t->_write_reg(write_ids[i], *values)) {
 			user_arg_0(writes - i);
 			return;
 		}
+		values++;
 	}
 	user_arg_0(0);
 	return;
diff --git a/base-hw/src/core/platform_thread.cc b/base-hw/src/core/platform_thread.cc
index 071fbeb9fe..ff9b161c6c 100644
--- a/base-hw/src/core/platform_thread.cc
+++ b/base-hw/src/core/platform_thread.cc
@@ -194,8 +194,8 @@ int Platform_thread::start(void * const ip, void * const sp)
 	addr_t * write_regs = (addr_t *)Thread_base::myself()->utcb()->base();
 	write_regs[0] = Reg_id::IP;
 	write_regs[1] = Reg_id::SP;
-	addr_t write_values[] = { (addr_t)ip, (addr_t)sp };
-	if (Kernel::access_thread_regs(id(), 0, WRITES, 0, write_values)) {
+	addr_t values[] = { (addr_t)ip, (addr_t)sp };
+	if (Kernel::access_thread_regs(id(), 0, WRITES, values)) {
 		PERR("failed to initialize thread registers");
 		return -1;
 	}
@@ -260,7 +260,7 @@ Thread_state Platform_thread::state()
 	Genode::memcpy(dst, src, size);
 	Thread_state thread_state;
 	Cpu_state * const cpu_state = static_cast<Cpu_state *>(&thread_state);
-	if (Kernel::access_thread_regs(id(), length, 0, (addr_t *)cpu_state, 0)) {
+	if (Kernel::access_thread_regs(id(), length, 0, (addr_t *)cpu_state)) {
 		throw Cpu_session::State_access_failed();
 	}
 	return thread_state;
@@ -275,7 +275,7 @@ void Platform_thread::state(Thread_state thread_state)
 	void  * dst = Thread_base::myself()->utcb()->base();
 	Genode::memcpy(dst, src, size);
 	Cpu_state * const cpu_state = static_cast<Cpu_state *>(&thread_state);
-	if (Kernel::access_thread_regs(id(), 0, length, 0, (addr_t *)cpu_state)) {
+	if (Kernel::access_thread_regs(id(), 0, length, (addr_t *)cpu_state)) {
 		throw Cpu_session::State_access_failed();
 	}
 };
diff --git a/base-hw/src/core/rm_session_support.cc b/base-hw/src/core/rm_session_support.cc
index 941dc458a2..8f262e92cd 100644
--- a/base-hw/src/core/rm_session_support.cc
+++ b/base-hw/src/core/rm_session_support.cc
@@ -140,8 +140,8 @@ void Pager_activation_base::entry()
 		enum { READS = sizeof(read_regs)/sizeof(read_regs[0]) };
 		void * const utcb = Thread_base::myself()->utcb()->base();
 		memcpy(utcb, read_regs, sizeof(read_regs));
-		addr_t * const read_values = (addr_t *)&_fault;
-		if (Kernel::access_thread_regs(thread_id, READS, 0, read_values, 0)) {
+		addr_t * const values = (addr_t *)&_fault;
+		if (Kernel::access_thread_regs(thread_id, READS, 0, values)) {
 			PWRN("failed to read fault data");
 			continue;
 		}