Thanks for reporting this bug. I have changed the length in Intercept.forward to uint8_t in the CVS head. lib/net/ctp and lib/net/lqi had default handlers for the forward call so had to update the respective forwarding engines as well. - om_p