The desc explicitly states this is the count of IPsec decryption errors — packets that failed to decrypt, for example due to a wrong key, corrupted ciphertext, or a mismatched algorithm. A rising value here on an established tunnel is a strong sign that the two peers' SAs have gone out of sync, commonly because one side rekeyed and the other is still using stale key material, and it manifests as intermittently dropped VPN traffic even though the tunnel shows as up. e.g. cpvSaDecrErr spiking right after one peer's clock drifted enough to desynchronize a rekey, causing packets encrypted under the new key to fail decryption on the still-old-keyed peer.