Hi Stefan,
Sorry, that probably wasn't very clear. Here's how I understand your scenario:
you're currently not using 'event disable all'
one iRule drops a connection using 'drop'
you see an error when calling HTTP::header insert after the prior 'drop' command
I'm saying that's surprising as I expected TMM to handle any subsequent iRule commands after a drop or reject command is used. It would be interesting to see what F5 Support would say for this.
That said, when you're using drop or reject, I think it's safe to call return and then event disable all immediately afterward to prevent any more iRule code from running. You shouldn't see any side effects to this assuming you want to close the connection and stop processing any more iRules.
Aaron