QoS Control is a 16-bit field that identifies the Quality of Service (QoS) parameter of a data frame (only in data frame type QoS-Data).QoS Control field is comprised of five subfields
1. [bit 0-3 ] Traffic Identifier (TID)
2. [bit 4 ]    End of Service Period (EOSP)
3. [bit 5-6 ] ACK Policy
4. [bit 7 ]   Reserved
5. [bit 8-15 ] TXOP limit, TXOP duration, AP PS buffer state, Queue Size

Below chart list which type of devices use bit 8-15  information. (CWAP study guide-page 104)

Here is a QoS Data type wireless frame capture shows the above subfields in QoS control field.WiFi uses EDCA- Enhanced Distributed Channel Access, a wireless access method that provides differentiated access for stations using 8 user priorities & 4 QoS Access categories (AC_VO, AC_VI, AC_BE, AC_BK). These UP values of a wireless frame map to QoS field (CoS/802.1D) of a 802.1q header when it translated to Ethernet frame(Page 105 – CWAP Official Study Guide).

WiFi alliance QoS certification called WMM-WiFi Multimedia also defined those 4 access categories. So WMM cetified end client should classified its traffic on to one of those classes prior to transmit them over the air.

Below shows the relationship between WMM Access categories & 802.1D tag values (Page 105 – CWAP Official Study Guide)

Here is the brief description of the QoS subfields

1st subfield (TID – Traffic Indicator)
4 bit value used to identify the user priority (UP) and traffic Access Category(AC) of a QoS data frame. 802.11 WMM clients use WMM-PS (power save) to indicate to an AP that STA is awake. Unlike in legacy PS, WMM-PS client can ask to deliver more than 1 frame.

2nd subfield (EOSP- End of Service Period)
1 bit value to indicate the end of a service period. If this bit set to 1, then client can go back to asleep.

3rd subfield (Acknowledge)
Specify the 2-bit Acknowledgement policy. There are four different options available
ACK :
No-ACK :
No Explicit ACK :
Block ACK:

4th subfield (Reserved)
Allocated for future use

5th subfiled
TXOP Limit: Indicate the transmitt opportunity granted by the AP
AP PS Buffer State : AP use this to indicate PS buffer state for a given client station.
TXOP Duration Requested: Client use this to tell AP how much time client station wants for its next TXOP. AP may choose to assign shorter TXOP as well.
Queue Size: Client station use that to inform AP how much buffered traffic it has to send. AP can use this information to determine duration for next TXOP to that client

Here is a two sample packet capture of QoS data frames when 7921 phone is communicating with 7960 phone in the given setup.

This is a RTP packet going from wireless client to wired phone. As you can see bit 4 set to 0 (TXOP Duration Requested in bit 8-15). Also TID is 6 indicating it is Access Class of Voice traffic.Below show a wireless packet coming from wired phone to the wireless client. In here bit  4 is used for EOSP. Also in this case bit8-15 (5th subfield) is AP PS Buffer state to tell client whether any buffer data available for 7921 phone.

Reference

1. CWAP Official Study Guide – Chapter 3