Hi Daniel,
passing capabilities as out parameters is expected to work when passing the cap as reference. Please find attached an example in the form of a patch, where I changed the signature of an RPC function to the use of an out parameter of a capability type.
Best regards Norman