(sorry about the previous email; trigger happy enter key)
While trying to remove decode_numeric_bitfield() calls, I came across some curious code in packet-ieee80211.c. "hf_ieee80211_block_ack_control_multi_tid_info" and "hf_ieee80211_block_ack_control_compressed_tid_info" both use decode_numeric_bitfield() with a 16-bit mask, yet the proto_tree_add_uint_format() they're wrapped up in only specifies a length of 1 (byte). Within the hf_ array they are also listed as a FT_UINT16 type.
Also there are a few other hf_ variables within the Multi-TID BlockAckReq and Multi-TID BlockAck handling that have proto_tree_add_* only specifying a length of 1, but the type is FT_UINT16 with a 16-bit mask. Should these even work?