marqs,
In the user-table on the controller it uses the "Browser Agent" to show the operating system, NOT the DHCP fingerprint. To see what browser agent the incorrectly classified user is showing, Giovanni can type "show aaa device-id-cache | include <mac address>":
(192.168.1.3) #show aaa device-id-cache | include 00:24:2c:3a:08:37
00:24:2c:3a:08:37 Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/20100101 Firefox/5.0 Wed Aug 3 19:55:32 2011
That will determine what application is causing the device to be misclassified.
Sometimes something as little as a weather APP causes the device to be misclassified.