diff --git a/lib/cwmp.ts b/lib/cwmp.ts
index 7c0362d..99ca591 100644
--- a/lib/cwmp.ts
+++ b/lib/cwmp.ts
@@ -1228,7 +1228,15 @@ async function processRequest(
   } else if (rpc.cpeResponse) {
     if (sessionContext.state !== 2) return reportBadState(sessionContext);
 
-    await session.rpcResponse(sessionContext, rpc.id, rpc.cpeResponse);
+    const fault = await session.rpcResponse(
+      sessionContext,
+      rpc.id,
+      rpc.cpeResponse
+    );
+    if (fault) {
+      recordFault(sessionContext, fault);
+      session.clearProvisions(sessionContext);
+    }
     return nextRpc(sessionContext);
   } else if (rpc.cpeFault) {
     if (sessionContext.state !== 2) return reportBadState(sessionContext);
diff --git a/lib/session.ts b/lib/session.ts
index f350a6e..bfa8313 100644
--- a/lib/session.ts
+++ b/lib/session.ts
@@ -2419,7 +2419,7 @@ export async function rpcResponse(
   sessionContext: SessionContext,
   id: string,
   _rpcRes: CpeResponse
-): Promise<void> {
+): Promise<Fault> {
   if (id !== generateRpcId(sessionContext))
     throw new Error("Request ID not recognized");
 
@@ -2514,6 +2514,14 @@ export async function rpcResponse(
     if (rpcReq.name !== "GetParameterValues")
       throw new Error("Response name does not match request name");
 
+    if (rpcRes.parameterList.length !== rpcReq.parameterNames.length) {
+      return {
+        code: `invalid_response`,
+        message:
+          "The list of parameters returned in the GetParameterValuesResponse message does not match the requested parameters",
+      };
+    }
+
     for (const p of rpcRes.parameterList) {
       toClear = device.set(
         sessionContext.deviceData,
@@ -2813,6 +2821,8 @@ export async function rpcResponse(
     for (const c of toClear)
       device.clear(sessionContext.deviceData, c[0], c[1], c[2], c[3]);
   }
+
+  return null;
 }
 
 export async function rpcFault(