When the EndpointReferenceImpl serializes ReferenceParameters it wrapps them in a <ReferenceParameters> element. That's correct for outbound addressing properties, within a Reply header however reference elements have to become first class elements (Not wrapped).