tshark two-pass NFSv4 skips valid operations

Individual NFSv4 opcodes are contained within a COMPOUND NFSv4 procedure. If one runs

tshark -r a.pcap -q -z rpc,srt,100003,4

to print the RTT of NFSv4 opcodes, you only get results for the COMPOUND procedure and not individual ops.

We have a script which parses the output of the nfs.main_opcode with a command like:

tshark -r a.pcap -2 -R "nfs.procedure_v4 and rpc.time" -T fields -e nfs.main_opcode -e rpc.time

This uses two-pass mode. However, when running this in single-pass mode like:

tshark -r a.pcap -Y "nfs.procedure_v4 and rpc.time" -T fields -e nfs.main_opcode -e rpc.time

We see a difference in the number of operations the two commands report.

Sometimes two-pass will either not print the opcode, or not even consider the operation in its analysis. Hand-counting operations shows that two-pass is inaccurate and single-pass is accurate.

Is this some behaviour of the NFSv4 dissector which we don't understand, or is this likely a bug in the NFSv4 two-pass dissector?

(note: most of our analysis so far has been done on packet captures where tcpdump has dropped at least some traffic due to buffer overrun during receive. We've yet to test this on a "perfect" packet capture)