This preserves the count of Phase-2 exchanges on an expired tunnel that referenced security parameters, such as an SPI, the local device didn't recognize, per its description - a more specific failure mode than a generic 'invalid' counter. This is a useful after-the-fact clue that a tunnel died from an SPI desync between peers rather than a policy or crypto mismatch. An admin seeing a large value here on a tunnel that terminated abruptly would suspect one side lost track of an SA index the other side kept using.