This counts packets the gateway rejected for carrying a TCP sequence number outside the expected range for an established connection. Like invalid ACKs, this specifically flags attempts to inject forged packets into an existing TCP stream, so admins correlate a rise here with the same source IP appearing in other spoofing-related counters before concluding it's an attack rather than ordinary packet loss or retransmission noise. For example, seeing this counter rise only for connections to one specific database server would point at a targeted session-injection attempt against that host.