This counter tracks the number of ingress lookups that were rejected specifically because the packet's DSCP value wasn't on the list this ACL entry permits. A rising count on one particular ACL entry means real traffic hitting that port doesn't match the DSCP class the entry was configured to allow, which is exactly the kind of mismatch that shows up when a neighboring device remarks traffic differently than expected. For example, an entry configured to allow only DSCP 46 (Expedited Forwarding) would see this counter jump from 0 to over a thousand within an hour if a downstream router starts sending DSCP 0 traffic through it instead.