Not sure I understand everything right, and the Wireshark API is a bit confusing at times... but why are you trying to handle this field as string? From my reading it's 1 byte, starting at offset 19 of your buffer.