It appears there may be an issue with the handling of ICMP flows when a non-standard action order is in use. Repro:
Runmode: af-packet action-order: Drop, Pass, Reject, Alert
drop icmp any any -> 184.108.40.206 any (msg:"Drop ICMP"; sid:10002;) pass ip any any -> any any (msg:"Pass IP"; sid:1004;) pass tcp any any -> any 22 (sid:1;)
If I run a ping to 220.127.116.11 the first packet is dropped, but the subsequent packets are allowed through.