diff --git a/bacnet-stack/bacdef.h b/bacnet-stack/bacdef.h
index 7bf0c7a7..be4bbbe9 100644
--- a/bacnet-stack/bacdef.h
+++ b/bacnet-stack/bacdef.h
@@ -81,6 +81,7 @@ struct BACnet_Device_Address {
 };
 typedef struct BACnet_Device_Address BACNET_ADDRESS;
 
+/* FIXME: move the string types into their own modules with unit testings */
 /* bit strings
    They could be as large as 256/8=32 octets */
 #define MAX_BITSTRING_BYTES 15
@@ -90,16 +91,20 @@ typedef struct BACnet_Bit_String
   uint8_t value[MAX_BITSTRING_BYTES];
 } BACNET_BIT_STRING;
 
+/* FIXME: create some init/add/remove helper functions in a library */
 typedef struct BACnet_Character_String
 {
   size_t length;
   char value[MAX_APDU];
 } BACNET_CHARACTER_STRING;
 
+/* FIXME: convert the bacdcode library to use this for APDU buffer
+   to prevent buffer overflows */
+/* FIXME: create some init/add/remove helper functions in a library */
 typedef struct BACnet_Octet_String
 {
   size_t length;
-  char value[MAX_APDU];
+  uint8_t value[MAX_APDU];
 } BACNET_OCTET_STRING;
 
 /* date */
@@ -120,6 +125,9 @@ typedef struct BACnet_Time
   uint8_t hundredths;
 } BACNET_TIME;
 
+/* note: with microprocessors having lots more code space than memory,
+   it might be better to have a packed encoding with a library to
+   easily access the data. */
 typedef struct BACnet_Object_Id
 {
   uint16_t type;
diff --git a/bacnet-stack/wp.c b/bacnet-stack/wp.c
index 7738ec19..1cf35c26 100644
--- a/bacnet-stack/wp.c
+++ b/bacnet-stack/wp.c
@@ -74,7 +74,9 @@ int wp_encode_apdu(
   return apdu_len;
 }
 
-// decode the service request only
+/* decode the service request only */
+/* FIXME: there could be various error messages returned
+   using unique values less than zero */
 int wp_decode_service_request(
   uint8_t *apdu,
   unsigned apdu_len,
@@ -125,6 +127,8 @@ int wp_decode_service_request(
       &apdu[len],
       apdu_len - len,
       &data->value);
+    /* FIXME: check the return value; abort if no valid data? */
+    /* FIXME: there might be more than one data element in here! */
     if (!decode_is_closing_tag_number(&apdu[len], 3))
       return -1;
     // a tag number of 3 is not extended so only one octet