It seems your edit did all the work for me. Being in the core of the MD2 compression function puts the Sbox in a good place to be a backdoor. However I strongl

It seems your edit did all the work for me. Being in the core of the MD2 compression function puts the Sbox in a good place to be a backdoor. However I strongly doubt this is one. The attacks that have broken MD2 do not seem to hinge terribly on the Sbox (I may be wrong, it was only a cursory look). It's more likely to me that the Sbox was generated using a hard-to-replicate Knuth shuffle using the digits of Pi.