With the gtk and caps USE flags on, the wireshark ebuild attempts to call "setcap cap_kill=ep /usr/bin/wireshark" in pkg_postinst. However, the only stable libcap, 1.10-r11, does not provide setcap.
Thank you for report Justin. That capset capkill is not required any more for wireshark so I just dropped it... FIXED.