sounds wierd, most common error is that people forget to run reboot command immediately after flush. If you happen to run or cat any file before reboot that was edited triggers automaticly malf flag.

But lets see I'll do some experiments with one of my extra n9's and get back to you if there would happen to be errors in script (although it has worked for me every time (but I'm using opensh with all capas)), your script is missing "reboot" line atleast. Are you sure that your next command after the flush was "reboot", ie you didnt try cat refhashlist before rebooting?

Second option is just to run "reboot" command right after the accli signature command. As that validator-init line is just fancy thing for one of my other hacks which actually might even be needed in this case.