This bug actually refers to release 3.9.2.  The version wasn't listed in the
version list box.

In trying to figure out how to put structures into tags, I discovered what
appears to be a coding error between count when issued on SetField and received
in a pointer on GetField when pass_count is TRUE and field_writecount is not
TIFF_VARIABLE2 (i.e., probably TIFF_VARIABLE).  I posit that TIFF_VARIABLE
should be a unint16 value and therefore _TIFFVSetField is wrong.  See below.

First the code from _TIFFVSetField in tif_dir.c at line 467:

            if(fip->field_passcount) {
            if (fip->field_writecount == TIFF_VARIABLE2)
            tv->count = (uint32) va_arg(ap, uint32);
            else
            tv->count = (int) va_arg(ap, int);  /// BUG?  
        } else if (fip->field_writecount == TIFF_VARIABLE
               || fip->field_writecount == TIFF_VARIABLE2)
        tv->count = 1;
        else if (fip->field_writecount == TIFF_SPP)
        tv->count = td->td_samplesperpixel;
        else
                tv->count = fip->field_writecount;

Next the code from _TIFFVGetField in tif_dir.c at line 855: 

    if (fip->field_passcount) {
        if (fip->field_readcount == TIFF_VARIABLE2) 
            *va_arg(ap, uint32*) = (uint32)tv->count;
        else    /* Assume TIFF_VARIABLE */
            *va_arg(ap, uint16*) = (uint16)tv->count; /// BUG?
        *va_arg(ap, void **) = tv->value;
        ret_val = 1;