Yup..I agree, this looks like a bug. Every time /etc/init.d/psa-firewall is called to stop the firewall, it also calls the firewall-emergency.sh script which ultimately removes the active.flag. So next time the system boots up, the psa-firewall script thinks the firewall service is disabled...