The issue is with ACE 10, which matches all IP traffic that is not caught by the previous 2 ACEs. ACE 10 redirects this traffic to the 172.25.1.150 address, located on a firewall. The problem is that VRRP packets (IP multicast with destination IP address of 220.127.116.11) that come in via VIST also match this ACE, and get redirected, effectively causing a loop. Looping VRRP packets caused Frame Buffer exhaustion on the Rx CPU queue, as well as egress queue drops on Queue 7 (network control) on the NNI port(s) used by VIST. Queue 7 is also used by IS-IS, and dropped IS-IS packets caused adjacency flaps.