Some toolchains provide a _NOINIT section (or similar) for values/variables which are not initialized during startup. Such a boot flag must reside there.
After power-up, RAM cells can contain random values. For our BL, we are using "safe" values for such variables, which consists of an array of 2 values. The first index contains the normal value, the second the binary negated value (e.g. 00/FF, 55/AA). This way, you can catch at least some corruptions, and add some additional safety.