This Counter64 counts the number of bad AH decrypted packets on this Virtual Interface, per its description, packets that failed processing during decrypt. An admin treats any sustained growth in this bad-packet counter as a sign of a key, algorithm, or replay-window mismatch on that specific protocol path, distinct from the SA-level failure counters which track whole-SA setup rather than per-packet errors. For example, an admin seeing bad AH decrypted packets accumulate on VI 27 linking a manufacturing-plant subnet despite SAs showing as established would suspect clock skew or a replay-window issue rather than a failed negotiation.