The extra IPC ack is triggered by a syscall that is invoked in ES's main function; the syscall literally just sets Y2, IX1 and IX2 in HW_IPC_ARMCTRL -- there is no complicated ack queue or anything.