RFC2030 part 3 says that the first bit of the payload is used as a flag to determine the time range (1968->2036 or 2036->2104).
The *ntp_to_nstime* function in *epan/dissectors/packet-ntp.c* references [rfc2030][1] but seems to use the first 4 bytes instead of using only the first bit [ref][2].
Note that this function is only used in *epan/dissectors/packet-zep.c*.
Note that the code is "duplicated" [here too][3].
[Here][4] is a commit that reference that part of the code.
I am looking a the code that is in the official Wireshark GitHub repo, last commit is aa78d3c.
(I tried to send this to
ask.wireshark.org but got treated as spam so I'm sending here)
The official Wireshark repo is at:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=tree
--