This is a running count of packets rejected by the filter when evaluated against Layer 4, port-based, rules, mirroring the L3 reject counter but for the port/service-based filtering described by the ipfL4UGM table. Admins use it alongside ipfInfoL3Rejects to determine whether traffic is being blocked due to IP-address group policy or port-based group policy. For example, if L4 rejects rise sharply after adding a new port entry to the L4 user-group table, it suggests that entry's group assignment is now blocking previously-allowed service traffic.