according the display filter reference https://www.wireshark.org/docs/dfref/d/dns.html the field dns.length is the "Length". I assume it's a length of DNS payload ( dns.length=udp.length - 20 (UDP header)). If I type "dns.length" (which means "dns.length is present") or "dns.length > 0" (which means dns.length is greater than 0) in the display filter field there are no matches. I If type "dns", wireshark shows all DNS packets. Other dns fields like "dns.resp.len" work as expected. Tested with both Wireshark versions 3.2.0 and 2.6.14
