Fix bug where capability pointers were corrupted when 'transferred', e.g. using adoptWithCaveats() or truncate().