Thanks Dorit
I appreciate the root cause of the installation failure may be distinct, however the result remains the same:
Internal error. Internal error in a hook script: X. (Return Code: 1). Contact Check Point Technical Services for further assistance. Error: uninstalling of Y failed - the machine might be in an unstable state. Contact Check Point Technical Services for further assistance.
In both cases, after installation failed, an uninstall was attempted. The uninstallation also failed, and left the system in an "unstable state". In our case key material became corrupt requiring a restore (mds_restore), in other cases it may require a backup or snapshot restore, which is not ideal when a) a hotfix is intended to fix issues rather than introduce them and b) if installation does fail, it shouldn't leave the system in an unrecoverable state especially when customers may not have recent or working backups.
Taking (or testing) backups and snapshots are best practice, but let's face it, not everyone does. I do as a habit, but like to reserve them for DR (both real and drill).
Root cause of hook script RC is still unknown but may have been related to missing/corrupt registry data for a failed CMA - we've recovered the CMA with TAC and will re-attempt the hotfix again tonight.