So the whole ELF file is protected by a signature you don't have known flaws in? Because AES-CTR and/or AES-CBC (actually especially CBC) gives me the willies without some kind of MAC.
Yeah, it's unauthenticated encryption, but think about their threat model. It's not about protecting integrity (the code signing takes care of that), it's about protecting the code from prying eyes (aka DRM). And the tradeoff with speed is likely why they choose CTR. That has bitten them in the ass before with key reuse, but by PS4 they've had about 10 years of experience with the SELF format now. While I doubt the format is completely secure, it's likely easier to find a flaw in FreeBSD9 (which is why CTurt tried to say).
It is usually hard to retain confidentiality if you don't also have integrity protection. My suggestion wasn't that people would be able to exploit the lack of a MAC to override settings or code in ELF files; it was that they could use that flaw to decrypt the code.