This counter tracks lookups that matched an authorized source address and port but were rejected specifically because the packet's DSCP marking wasn't one this ACL entry permits, per the DSCP-mask mechanism described in cienaCesAclEntryDscpMask. An admin sees this counter growing when traffic from an otherwise fully-authorized source is being marked with an unexpected or unauthorized QoS class, which could indicate a misconfigured upstream device applying the wrong DSCP marking, or a deliberate attempt to abuse an ACL exception scoped too narrowly by DSCP. For example, if an authorized server starts marking its traffic with a new DSCP value after a software update that wasn't accounted for in the ACL entry's allowed DSCP mask, this counter would begin climbing even though the source address itself remains correctly authorized.