This counter records the number of packets dropped at this flow point due to an explicit ACL rule match, as opposed to the no-match case. A rising count tells the admin that a specific configured deny rule is actively blocking traffic at this flow point, which is useful for confirming a security policy is working versus accidentally too restrictive. For example, if a customer's traffic to a specific destination is unexpectedly blocked, the admin would check cmFlowPointStatsAclRuleDrop to confirm an explicit ACL deny rule, not the no-match catch-all, is responsible.