That seems to come from /sbin/preinit if /sbin/getbootstate returns "MALF" (well, any unexpected value really but that's the only one I can see with strings(1) that isn't handled). Beyond that, without source, your guess is as good as mine...