geli boot- never attempts to decrypt, fails at mountroot

loader.conf

aesni_load="YES"
kern.racct.enable=1
geom_eli_load="YES"
kern.geom.label.disk_ident.enable="0"
kern.geom.label.gptid.enable="0"
zfs_load="YES"
vfs.zfs.arc_max=128M

geli_vtbd0p4_keyfile_load="YES"
geli_vtbd0p4_keyfile_type="vtbd0p4:geli_keyfile0"
geli_vtbd0p4_keyfile_name="/boot/zroot.key"
vfs.root.mountfrom="zfs:zroot/ROOT/default"

GPT partition layout on vtbd0 with 4 partitions
1 freebsd-boot
2 freebsd-ufs 1G partition with /boot
3 freebsd-swap
4 freebsd-zfs, geli encrypted with 256-bit zroot.key that's on vtbd0p2

this same setup works successfully on different machines; the only differences are the following

- identifiers- zpool name, filename of key, etc (loader.conf is identical otherwise, as far as i can tell from visual inspection)
- actual number of partitions (some hosts don't have swap, some hosts have additional partitions)
- amount of memory, size of disk, etc (this host has only 512MB memory)
- actual hypervisor being provided by my hosting provider (don't see how that would matter though)

among the systems, the kernels, /boot/loader binary, /boot/kernel/geom_eli.ko binary, are all identical as confirmed by md5

other notes

- the problem host in question doesn't display any messages about geli during boot, other than the loader noting that it has loaded the key and the specified modules
- it just arrives at mountroot, which fails (since the provider hasn't been decrypted)
- booting from a CD, i can geli attach without issues, using the key in vtbd0p2
- default options on geli except keysize 256

wondering what further steps i can take to diagnose this issue
thanks