It is possible that the traffic is hitting a different policy. Can you provide the output of "debug flow basic"?
set ff dst-ip 10.9.8.7 dst-port 445
set ff dst-ip 100.101.102.103 dst-port 445
set ff src-ip 10.9.8.7 src-port 445
set ff src-ip 100.101.102.103 dst-port 445
debug flow basic
Wait for traffic...
undebug all
get db str