In the case of a non-jnlp applet that have java version specified by either "java_version" parameter, CLASSID, or "application/x-java-applet;version=..." mimetype.
When the specified version specifies a range, like "1.7*" or "1.6+" (specified in any of the three methods) and the DRS run rule specifies a (non-force) version (say "1.7.0_51") that is in the range (and is installed).
Then if the applet is run with a later version of deployment code, (say "1.7.0_65"). It will block instead of running with 1.7.0_51.
There is also an error here in the error message when the applet should block:
If the same DRS is used on an applet specifying a non-matching range, say "1.6*" or "1.6.0_85", the error message will say:
"Deployment Rule Set required Java version 1.7.0_51 is not available or is incompatible with version 1.7.0_51 requested by the application."
when it should say:
"Deployment Rule Set required Java version 1.7.0_51 is not available or is incompatible with version 1.6* requested by the application."