This counter tracks lookups that matched a source address entry in the ACL but were rejected specifically because the traffic arrived on a physical ingress port that entry doesn't authorize, distinct from a source-address mismatch entirely. An admin sees this rising when a legitimate source address has been added to the ACL but scoped to the wrong physical port, or when traffic from that authorized source is arriving via an unexpected path due to a topology change or an attempted spoofing attempt from a different port. For example, if a partner's source subnet was authorized for port 3 but a network re-cabling moved that link to port 5, this counter would climb as previously-fine traffic now fails the port-scope check on the ACL entry.