How is CEF exception traffic handled inside a cppr policy in Cisco IOS-XE?

Question

Cisco

Wrote cppr policies for Cisco routers on IOS and IOS-XE.
And I ran into the following problem: on IOS-XE hardware there is no control-plane cef-exception mode, all traffic to the box is processed within a single policy. And in this policy it is not possible to catch BFD packets in any way. By the counters, I see that all BFD packets settle on the final discard rule. In standard IOS, BFD does not, in theory, fall into cef and is processed inside the control-plane cef-exception; I don’t understand what to do in the case of IOS-XE - it’s strange that the traffic does not fall into the desired class, but at the same time inside the filter it falls not into the class-default, but into the discard-all-UDP rule.
Hardware: ASR1002
IOS-XE ROMMON version: 153-1r
IOS-XE version: 03.14.00.S Internal
IOS version: 15.5(1)S
Selection rule for BFD (simplified config):
ip access-list extended RE_bfd
permit udp object-group ext_hosts range 49152 65535 object-group int_hosts range 3784 3785
! then the class where the BFD is included:
class-map match-any RE_routing
match access-group name RE_bfd
! discard rules
ip access-list extended RE_dis_tcp
permit tcp any any fragments
permit tcp any any
ip access-list extended RE_dis_udp
permit udp any any fragments
permit udp any any
ip access-list extended RE_dis_ip
permit icmp any any fragments
permit ip any any fragments
permit ip any any
! discard class
class-map match-any RE_dis_traffic
description RE_disable_traffic
match access-group name RE_dis_tcp
match access-group name RE_dis_udp
match access-group name RE_dis_ip
! and all this in the cppr policy:
policy-map RE_cppr
class RE_routing
class RE_dis_traffic
police rate 1 pps
! enable
control-plane
service-policy input RE_cppr
!
UPD: There is a similar problem with LDP traffic, so I tend to think that it is typical for all CEF-exception packets inside the box.

Answer 1

So, I eliminated the symptoms of the problem.
The original ACL for selection was:
!
permit udp object-group ext_hosts range 49152 65535 object-group int_hosts range 3784 3785
!
Actually, the idea arose to play with the conditions and I removed the restriction on addresses. ACL has become:
!
permit udp any range 49152 65535 any range 3784 3785
!
And everything worked! But the question is still open - the symptom has been eliminated, why ASR does not process the condition on ip-headers - it is not clear. Bug or feature of host-inbound traffic processing on IOS-XE?
UPD: All the fuss arose due to the fact that object-groups do not work inside the ACL for cef-exception traffic. For the rest of the host-inbound traffic, they work.
If instead of object-groups directly write ip-addresses, then everything works as it should.

Answer 2

The most likely answer is that there is no CEF on XE hardware. There is an analogue of QFP, through which everything goes. On the previous hardware, this architecture is not