Macos Mojave: how to deal with corrupted bsd_flag in a private/var directory

Oh dear. If you're seeing the .HFS+ Private* directories, you're likely using a very old version of your HFS+ driver on Ubuntu. I would stop using this immediately and update to something more current.

Basically, the purpose for that directory is that HFS+ doesn't support hard links—not really—and UNIX, upon which OS X/macOS is based, requires them. So what they did was to use a really obnoxious duct-tape kludge to simulate hard links; any file that has more than one link is moved into one of those invisible directories as an "inode"; the actual hard links are really just aliases to the "inode" file with a special flag set in its metadata. There's also a second HFS+ Private Data folder that holds something else; I can't remember what it is anymore, but it's another thing like this that really should be a file-system-level feature, but isn't.

So basically, if you're using an HFS+ driver that shows those folders, you're basically dealing with an older version of the spec. If you interact with files in that directory, you can mess up your drive but good. And if you delete it—well—just don't. Find a newer version of the driver that supports the latest version of the spec, or better yet, upgrade to APFS, which is implemented in a much more sensible manner (or so we assume; they still haven't published the specification on the thing AFAIK).

If you suspect disk0s2 is is actually a APFS container, then you change the partition type in the GUID Partition Table (GPT) to APFS. Normally one would first hex dump the beginning of disk0s2 to see if the content matches what is expected for a APFS container. Apparently, the is difficult from Recovery mode. A last resort would be to see if the APFS magic number would be the characters NXSB. This can done by entering the commands given below.

dd if=/dev/disk0s2 count=4 skip=32 bs=1 2>/dev/null; echo

If the partition is a APFS container, then the following be output.

NXSB

Note: Any error messages produced by dd command will not be shown. To display these messages omit 2>/dev/null. Doing so on a APFS container partition would produce an output similar to what is shown below.

NXSB4+0 records in
4+0 records out
4 bytes transferred in 0.020234 secs (198 bytes/sec) 

However, if you look at the dd output already posted to your question, you can see the NXSB characters.

If you can boot Ubuntu, then you could hex dump the first sector of the APFS container partition by entering the command given below.

sudo hexdump -Cv -n 512 /dev/sda2

Changing the partition type from Core Storage to APFS

The easiest way to change a partition type is to use the third party gdisk command. This command can be run from Ubuntu already installed on your Mac.

You can make the partition type change form Ubuntu by using the gdisk command. You will need version 1.0.4 of gdisk. If you have an older version then download and install the updated version from the SourceForge GPT fdisk website. The command to enter is given below.

sudo gdisk /dev/sda

Below is an example of the proper interaction with gdisk.

GPT fdisk (gdisk) version 1.0.4

Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): t
Partition number (1-8): 2
Current type is 'Apple Core Storage'
Hex code or GUID (L to show codes, Enter = 8300): af0a
Changed type of partition to 'Apple APFS'

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): y
OK; writing new GUID partition table (GPT) to /dev/sda.
Warning: The kernel is still using the old partition table.
The new table will be used at the next reboot or after you
run partprobe(8) or kpartx(8)
The operation has completed successfully.

You can also change the partition type from macOS. The different ways to boot are as follows.

• Boot from an external drive with macOS already installed. Open a Terminal application window to enter the necessary commands.
• Boot to macOS Recovery over the Internet. Once booted over the Internet, you can open a Terminal window to enter the necessary commands.
• Use another Mac to create a USB bootable installer for macOS. Once booted to the installer, you can open a Terminal window to enter the necessary commands.
• Boot the Mac in Target Disk mode and connect to another Mac. In this case, the drive will not be disk0. You will need to run diskutil list to determine the correct identifier.

The commands to enter are shown below.

sudo diskutil unmountdisk disk0
sudo gpt remove -i 2
sudo diskutil unmountdisk disk0
sudo gpt add -i 2 -b 409640 -s 725609832 -t 7C3457EF-0000-11AA-AA11-00306543ECAC /dev/disk0

Note: Most of gpt commands require the drive to be unmounted. Since macOS likes to auto mount partitions, you may need to enter the command diskutil unmountdisk disk0 before entering each gpt command.