[Cooker] tcpwrappers - why this line does not work?

[Borsenkow Andrej]

sshd: X.Y.Z.0/255.255.255.0 EXCEPT X.Y.Z.17/255.255.255.255: ALLOW

That still allows X.Y.Z.17 even if the only remaining rule denies
everything:

ALL:ALL EXCEPT localhost:DENY

-andrej