The ACL is accepted in the config, but TCAM is full and the new deny rule is never programmed into hardware

Operators trust the running configuration, yet packets keep flowing because the forwarding ASIC could not install the rule set.