Why do ACLs use wildcard masks instead of subnet masks?

Wildcards are match patterns, not network definitions, and the inversion buys generality. In a wildcard, 0 means "this bit must match" and 1 means "don't care." For a whole subnet that's just the inverted mask (255.255.255.0 → 0.0.0.255, i.e., subtract each octet from 255). But wildcards can express things a subnet mask can't: 0.0.1.255 matches a pair of /24s; 0.255.0.255 matches a pattern across octets. Two idioms to memorize: 0.0.0.0 = exactly one host (routers display it as host), 255.255.255.255 = anything (any). The same syntax appears in network statements for OSPF, so mixing up mask vs wildcard breaks adjacencies too — /tools/wildcard-mask-converter flips them for you until it's automatic.