I’ve been compelled to attempt to ascertain how sysinstall(8) is started from mfsroot[.gz] on multiple occasions. For various reasons, I never actually discovered the answer until I eventually encountered a scenario where my interest was peaked…I broke down and emailed freebsd-questions. I’d like to thank Jeremy for his response below!

It’s spawned by the kernel. Really. You’re probably used to the kernel
spawning /sbin/init, except that doesn’t exist in this environment. And
you probably don’t see the message about it on VGA console because
screen gets cleared immediately by sysinstall(8) right after it’s
printed. On serial console it’s much more evident — look closely at
the output (read slowly) and note the line right after “Trying to mount
root…”:

http://jdc.koitsu.org/freebsd/pxeboot_serial_install_8.html#ATTEMPTING-BOOT

The loader(8) variable called init_path defines a colon-delimited list
of executables for the kernel to attempt to run. The default value for
init_path is hard-coded into /boot/kernel/kernel. You can see it with
strings(1) if you want, but it defaults to this:

/sbin/init:/sbin/oinit:/sbin/init.bak:/rescue/init:/stand/sysinstall

None of those, sans /stand/sysinstall, exist under mfsroot. The rest
you can figure out yourself. Image may be NSFW.
Clik here to view.

You can override this by setting something [http_path] in loader.conf or by changing
the default in the kernel yourself.

…

I added init the boot_crunch file and the image started init(8) as opposed to sysinstall(8).