Last thing first:
on the dreambox will show that init is running at runlevel 3 (that's what the final 3 in square brackets means).
Boot sequence: (please take this with a small pinch of salt. I've haven't tried any of this for a long time, and I can't be bothered to check the facts. Sorry...)
1. The box executes a primary boot loader stored in a ROM in the box. This ROM is not re-programmable, so it is safe from user errors.
2. Some kind of non-volatile read/write memory is used by the primary boot loader to keep the "environment", like where to boot from etc. Normal boot sequence is to load the secondary boot loader from the first few blocks on the flash (this is a separate partition).
3. The secondary boot loader will first check if there is a FAT-formatted partition on CF containing the file "autoexec.bat". If so, this partition will be used to boot. If not present, the secondary boot loader opens the second partition on flash (jffs2 formatted) and finds the file "autorun.bat". First line is the name of the boot logo, second line is the name of the (compressed) kernel.
4. The bat file may contain (at least on CF, not sure on flash) kernel boot parameters. "console=ttyS0,115200" is probably the one you want.
5. The kernel gets uncompressed, starts up, etc. etc.
The secondary boot loader will stop if the front-panel "up" key is pressed when it starts. It will then accept a web connection to flash the box, but it will also accept a telnet connection (ANSI escape sequences) to change the environment. Be careful! I don't know any way to fix a seriously f*cked up environment, so it's probably best to leave it alone.
The boot partition is normally mounted read-only. If you want to take the risk it can be re-mounted read-write
mount -o rw,remount /boot
And yeah, you should probably confine your experiments to a CF. Then you just need to unplug it if you do something wrong.