Okay, too weird:

# grep tty00 /etc/ttys
tty00   "/usr/libexec/getty std.115200" vt220   on secure mdmbuf
# stty -a -f /dev/tty00
[...]
cflags: cread cs8 -parenb -parodd hupcl -clocal -cstopb -crtscts -mdmbuf
[...]
0:AL:/usr/src/sbin/ttyflags
# ttyflags -v tty00
ttyflags: setting flags on /dev/tty00 to mdmbuf
0:AL:/usr/src/sbin/ttyflags
# stty -a -f /dev/tty00
[...]
cflags: cread cs8 -parenb -parodd hupcl -clocal -cstopb -crtscts -mdmbuf
[...]

If I manually stty tty00 to mdmbuf, it gets set, and I can log in normally...
at which point, mdmbuf has been cleared again.

What obvious thing am I overlooking that explains why mdmbuf doesn't stay set?
ttyflags doesn't seem to be encountering any errors.

-s