What is a design application of control plane policing?

CoPP applies QoS rate-limiting policies to traffic destined for the route processor, throttling or dropping traffic patterns associated with reconnaissance activity (such as ICMP sweeps) and DoS attacks (such as high-rate protocol floods targeting the CPU). This preserves the stability and availability of routing protocols, management sessions, and other control plane functions that depend on CPU resources.

CoPP operates on traffic directed to the control plane (route processor), not on through-traffic in the forwarding plane - policing legitimate versus excessive transit traffic is handled by data plane QoS features like MQC or CBWFQ applied to interfaces.

Dropping malformed packets sent to the CPU is a secondary behavior of CoPP, not its primary design application - the fundamental purpose is protecting the control plane from reconnaissance and DoS attacks, not malformed packet filtering.