This article describes drop packet error reason "Encrypt failed with invalid flow context"

Can be found on "monitor security packet-drop" and "show security packet-drop records":

Dropped by IPSEC:Encrypt failed with invalid flow context

After route look-up, if the packets supposed to go through tunnel then the flow context of those packets will marked for encryption/decryption otherwise those packets will be dropped. The counter "encrypt failed with invalid context" signifies the packet are not encrypted because the flow context is not marked for encryption.

This, then, usually happens when there's a routing issue, like for example a packet out of st0.0 that gets routed back to st0.0 due to routing misconfiguration.