diff --git a/doc/bird.sgml b/doc/bird.sgml
index ff599216..90ceb184 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -5094,6 +5094,8 @@ Bitmask matching is written using <m/value/<cf>/</cf><m/mask/ or
 <cf/!/<m/value/<cf>/</cf><m/mask/ pairs. It means that <cf/(/<m/data/ <cf/&/
 <m/mask/<cf/)/ is or is not equal to <m/value/. It is also possible to use
 multiple value/mask pairs connected by logical operators <cf/&&/ or <cf/||/.
+Note that for negated matches, value must be either zero or equal to bitmask
+(e.g. !0x0/0xf or !0xf/0xf, but not !0x3/0xf).
 
 <sect2>IPv4 Flowspec
 
diff --git a/lib/flowspec.c b/lib/flowspec.c
index 14b42b52..df5c8da3 100644
--- a/lib/flowspec.c
+++ b/lib/flowspec.c
@@ -815,8 +815,8 @@ flow_builder_add_op_val(struct flow_builder *fb, byte op, u32 value)
  * @mask: bitmask
  *
  * It is required to set appropriate flowspec component type using function
- * flow_builder_set_type(). This function should return 1 for successful adding,
- * otherwise returns 0.
+ * flow_builder_set_type(). Note that for negation, value must be zero or equal
+ * to bitmask.
  */
 int
 flow_builder_add_val_mask(struct flow_builder *fb, byte op, u32 value, u32 mask)