Curious:

If Hijack kernel only executes first file it finds per your list, and /sbin/hijack exists as empeg-preinit, then why would modifying /sbin/init lock the player (assuming mod was destructive)?

lothar