You're not alone. People often get confused with policing calculations.
Your bucket size is 8000 bytes. This means you are allowed to send 8000 bytes from your bucket within Tc period.
To simplify assume you receive packets every 5 msec (0.005 sec). You add tokens at the rate of (0.005 * 884000) = 4420 bits in 0.005 sec = 552 bytes. That means you are allowed to add 552 bytes to your bucket every 0.005 seconds.
Assume you started with your bucket full. You have 8000 bytes in it. 0.005 seconds later, you received 5000 bytes in a packet. This packet conforms because you have 8000 bytes in your bucket. So set-dscp-transmit is executed. 8000-5000=3000 bytes remain in your bucket. Referring previous calculation, you add 552 bytes to your token in 0.005 secs later. Your bucket has 3552 bytes in it. Now another packet arrives with 4000 bytes in it. This is more than the bytes in your bucket (3352). So you execute exceed action drop the packet. Referring previous calculation, you add 552 bytes to your token in 0.005 secs later. Your bucket now has 4114 bytes in it. Now another packet arrives with 4000 bytes in it. This packet conforms because you have 4114 bytes in your bucket. So set-dscp-transmit is executed. 4114-4000=114 bytes remain in your bucket. Then there is a silence of 0.5 second period you did not receive any packets. This means 552*100=5520 bytes get added to your bucket.
I hope this helps.
