diff --git a/src/core/hle/ipc_helpers.h b/src/core/hle/ipc_helpers.h
index 61573b153..d7127e899 100644
--- a/src/core/hle/ipc_helpers.h
+++ b/src/core/hle/ipc_helpers.h
@@ -121,7 +121,11 @@ public:
     [[deprecated]] void PushStaticBuffer(VAddr buffer_vaddr, size_t size, u8 buffer_id);
     void PushStaticBuffer(const std::vector<u8>& buffer, u8 buffer_id);
 
-    void PushMappedBuffer(VAddr buffer_vaddr, size_t size, MappedBufferPermissions perms);
+    [[deprecated]] void PushMappedBuffer(VAddr buffer_vaddr, size_t size,
+                                         MappedBufferPermissions perms);
+
+    /// Pushes an HLE MappedBuffer interface back to unmapped the buffer.
+    void PushMappedBuffer(const Kernel::MappedBuffer& mapped_buffer);
 };
 
 /// Push ///
@@ -213,6 +217,11 @@ inline void RequestBuilder::PushMappedBuffer(VAddr buffer_vaddr, size_t size,
     Push(buffer_vaddr);
 }
 
+inline void RequestBuilder::PushMappedBuffer(const Kernel::MappedBuffer& mapped_buffer) {
+    Push(mapped_buffer.GenerateDescriptor());
+    Push(mapped_buffer.GetId());
+}
+
 class RequestParser : public RequestHelperBase {
 public:
     RequestParser(Kernel::HLERequestContext& context, Header desired_header)
@@ -333,8 +342,11 @@ public:
      * @param[out] buffer_perms If non-null, the pointed value will be set to the permissions of the
      * buffer
      */
-    VAddr PopMappedBuffer(size_t* data_size = nullptr,
-                          MappedBufferPermissions* buffer_perms = nullptr);
+    [[deprecated]] VAddr PopMappedBuffer(size_t* data_size,
+                                         MappedBufferPermissions* buffer_perms = nullptr);
+
+    /// Pops a mapped buffer descriptor with its vaddr and resolves it to an HLE interface
+    Kernel::MappedBuffer& PopMappedBuffer();
 
     /**
      * @brief Reads the next normal parameters as a struct, by copying it
@@ -497,4 +509,11 @@ inline VAddr RequestParser::PopMappedBuffer(size_t* data_size,
     return Pop<VAddr>();
 }
 
+inline Kernel::MappedBuffer& RequestParser::PopMappedBuffer() {
+    u32 mapped_buffer_descriptor = Pop<u32>();
+    ASSERT_MSG(GetDescriptorType(mapped_buffer_descriptor) == MappedBuffer,
+               "Tried to pop mapped buffer but the descriptor is not a mapped buffer descriptor");
+    return context->GetMappedBuffer(Pop<u32>());
+}
+
 } // namespace IPC
diff --git a/src/core/hle/service/am/am.cpp b/src/core/hle/service/am/am.cpp
index 30c4828b8..1f33a6d4c 100644
--- a/src/core/hle/service/am/am.cpp
+++ b/src/core/hle/service/am/am.cpp
@@ -520,7 +520,7 @@ void DeleteContents(Service::Interface* self) {
     u8 media_type = rp.Pop<u8>();
     u64 title_id = rp.Pop<u64>();
     u32 content_count = rp.Pop<u32>();
-    VAddr content_ids_in = rp.PopMappedBuffer();
+    VAddr content_ids_in = rp.PopMappedBuffer(nullptr);
 
     IPC::RequestBuilder rb = rp.MakeBuilder(1, 0);
     rb.Push(RESULT_SUCCESS);
@@ -534,7 +534,7 @@ void GetProgramList(Service::Interface* self) {
 
     u32 count = rp.Pop<u32>();
     u8 media_type = rp.Pop<u8>();
-    VAddr title_ids_output_pointer = rp.PopMappedBuffer();
+    VAddr title_ids_output_pointer = rp.PopMappedBuffer(nullptr);
 
     if (!Memory::IsValidVirtualAddress(title_ids_output_pointer) || media_type > 2) {
         IPC::RequestBuilder rb = rp.MakeBuilder(2, 0);
@@ -679,7 +679,7 @@ void ListDataTitleTicketInfos(Service::Interface* self) {
     u32 ticket_count = rp.Pop<u32>();
     u64 title_id = rp.Pop<u64>();
     u32 start_index = rp.Pop<u32>();
-    VAddr ticket_info_out = rp.PopMappedBuffer();
+    VAddr ticket_info_out = rp.PopMappedBuffer(nullptr);
     VAddr ticket_info_write = ticket_info_out;
 
     for (u32 i = 0; i < ticket_count; i++) {
@@ -754,7 +754,7 @@ void GetTicketList(Service::Interface* self) {
     IPC::RequestParser rp(Kernel::GetCommandBuffer(), 9, 2, 2); // 0x00090082
     u32 ticket_list_count = rp.Pop<u32>();
     u32 ticket_index = rp.Pop<u32>();
-    VAddr ticket_tids_out = rp.PopMappedBuffer();
+    VAddr ticket_tids_out = rp.PopMappedBuffer(nullptr);
 
     IPC::RequestBuilder rb = rp.MakeBuilder(2, 0);
     rb.Push(RESULT_SUCCESS);