It seems that for this message type the fields are incorrect. One possibly better definition would be (in protocol.def):
message 0x22 MSG_COMMAND_LIST
uint16_t itemNumber
uint16_t listLength
uint8_t commandID
uint8_t p1
int16_t p2
int32_t p3
int32_t p4