This Counter64 totals decryption operations across all current and previous Phase-1 control tunnels that failed to yield the original payload, per its description - meaning a received IKE message couldn't be successfully decrypted with the negotiated key. It's a strong indicator of a key mismatch or corruption issue specifically in the crypto operation itself, distinct from an authentication or hash-validation failure. A tunnel or device-wide spike in this counter right after a rekey event would suggest the new key material wasn't correctly synchronized between peers.