The desc explicitly states this is the count of policy errors — VPN packets rejected due to a policy mismatch, such as traffic that doesn't match the encryption domain defined for that tunnel. This typically surfaces as 'some traffic through the VPN works but other traffic doesn't', since it specifically counts packets that arrive expecting encryption or decryption under a policy that doesn't actually cover them — a common symptom of an encryption domain not updated after a new subnet was added behind one site. e.g. cpvErrPolicy rising after a new /24 subnet was added at a branch office but never added to that tunnel's encryption domain on both sides.