Hi Shaun
This is the buffer content that I receive from the Murata Module that I use:
0x63, 0x00, // overall length
0x01, 0x00, // command type MLAN_TYPE_CMD
0x03, 0x80, // command (response) = HostCmd_CMD_GET_HW_SPEC
0x5F, 0x00, // command length
0x03, 0x00, 0x00, 0x00, // header sequence number and result
// HostCmd_DS_GET_HW_SPEC
0x02, 0x00, // hw_if_version[2]
0x10, 0x48, // version
0x00, 0x00, // reserved
0x40, 0x00, // num_of_mcast_adr
0xC4, 0xAC, 0x59, 0xA4, 0x51, 0x27, // permanent_addr
0x10, 0x00, // region_code
0x02, 0x00, // number_of_antenna
0x24, 0x5B, 0x0E, 0xBC, // fw_release_number
0x00, 0x00, 0x00, 0x00, // hw_dev_cap
0x00, 0x00, 0x00, 0x00, // reserved_2
0x00, 0x00, 0x00, 0x00, // reserved_3
0xA3, 0x0B, 0x24, 0x00, // fw_cap_info
0x33, 0x00, 0x81, 0x24, // dot_11n_dev_cap
0x11,// dev_mcs_support
0x0B, 0x00, // mp_end_port
0x08, 0x00, // mgmt_buf_count
0x00, 0x00, 0x00, 0x00, // reserved_8
0x00, 0x00, 0x00, 0x00, // reserved_9
0x00, 0x00, 0x00, 0x00, // Dot11acDevCap
0x00, 0x00, 0x00, 0x00, // Dot11acMcsSupport
// additional / optional (?) TLVs
0xC7, 0x01, 0x04, 0x00, 0x01, 0x00, 0x02, 0x00,
0xC7, 0x01, 0x04, 0x00, 0x02, 0x00, 0x0E, 0x00,
0xC7, 0x01, 0x04, 0x00, 0x05, 0x00, 0x00, 0x00
I have commented the meaning of the content (mostly HostCmd_DS_GET_HW_SPEC) but I find that there are 24 additional bytes included that decode as 3 TLVs with Type 0x01c7, length 0x0004 and then 4 bytes values as seen. Since these are included in the total length and also represent valid TLV layout they look to be legitimate entries.
I haven't look at the linked document yet as the download server seems to be down for the moment but will do so later.

Regards
Mark