The desc explicitly states this is the count of IPsec policy errors — decrypted packets that didn't match the expected security policy for that SA, a similar concept to cpvErrPolicy but at the individual SA layer rather than the VPN-1 encryption-domain layer. This typically means a packet arrived correctly encrypted and decrypted under a valid SA but with source or destination addresses outside what that SA's policy permits, the IPsec-layer version of an encryption-domain mismatch, again usually traced back to a subnet added on one side without matching configuration on the other. e.g. cpvSaPolicyErr rising after traffic from a newly added subnet started arriving through an SA whose policy hadn't yet been updated to cover it.