This counter counts authorization responses that were rejected purely because the packet was malformed (invalid length), specifically excluding bad-authenticator or unknown-type failures which have their own counters, aggregated across all servers handling authorization. As with its authentication-phase counterpart, a nonzero value here points an admin toward TACACS+ server software or protocol compatibility issues rather than a permissions problem, since the packet never got far enough to be evaluated as an accept or reject. For example, this could appear after enabling a TACACS+ server feature the switch's client code doesn't fully support.