4.6.36 >=1 to >=6   this is an error.

1(reason) + 1(length) + 2(me type) + 2(me len)

4.6.37 len should be 4.

4.6.40 should be >= 22

4 (Vendor ID) + 4+4+1 (Model Number) + 4+4+1(Serial Number)

4.6.47 >0   to >=1

4.6.34 should define the "State" use a similar way used by 4.6.50 define 
the 'Static"


4.8.5 IdleTimeout is a timer. maybe need to be put into 4.7

4.7.11 ResponseTimeout, and 4.7.16 WaitJoin can be removed, since they are not 
used any more.

6.2 Join Response
Should MUST ME be defined earlier than MAY ME?

8.9 Clear Config Response:

   The Clear Configuration Request message MUST include the following
   message element.

   o  Result Code, see Section 4.6.35

Shoule be RESPONSE here.

9.1 Figure 7. Is this a reasonable case?

If images are same, the WTP will go into Configure state.

9.1.1

  The decision that new firmware is to be downloaded to the WTP can
   occur in one of two ways:

      When the WTP joins the AC, the Join Response message includes the
      Image Identifier message element, which informs the WTP of the
      firmware it is expected to run. if the WTP does not currently have
      the requested firmware version, it transmits an Image Data Request
      message, with the appropriate Image Identifier message element.
      If the WTP already has the requested firmware, it simply resets.

Remove "If the WTP already has the requested firmware, it simply resets."?

9.6 Data transfer req

What's the use of Data transfer mode 4.6.17? The Data Transfer Data has the 
mode field.

9.7 Data Transfer Response

   Upon receipt of a Data Transfer Response message, the WTP transmits
   more information, if more information is available.

What's this meaning of this? If the crash data or memory dump is too large, 
WTP will segment them, and transfer them using multiple Data transfer req 
messages.
The AC should maintain the
data offset by itself?   Or you want to say, the WTP will first sent
crash dump. It will send the memory
dump after it receives the response?