[winstrex]

What

Follow-up to #4200. kern.rng_pseudo and kern.arandom (MIB {1, 37} and its sysctlbyname name, both added by #3700) were the last guest entropy sources still drawing from a static std::random_device, one call per output byte. They now fill the buffer with HostEntropy_nid_no_patch (getentropy, rand_s on Windows), like arc4random, /dev/random and sceRandomGetRandomNumber since #4200.

Only the entropy source changes. kern.rng_pseudo still fills *oldLength bytes and leaves the length as it was, returns EPERM for a write and throws without an output buffer; kern.arandom still returns min(*oldLength, 256) bytes, reports that size for a null buffer and returns EPERM for a write. The two docs/dev/debt/libkernel.md entries now name host OS entropy instead of std::random_device.

On the AMD EPYC 9V45 runner measured in #4200, a std::random_device call took about 23.5 µs, so one call per byte cost about 1.5 ms for the 64-byte blocks mbedTLS asks kern.rng_pseudo for and 6 ms for a 256-byte kern.arandom read.

Tested

Windows 11, WinLibs GCC 15.2.0 r7, Release.

• guest_system_configuration (CheckPseudoRandomSysctl, CheckArandomSysctl), guest_posix_random, guest_random and guest_crt pass.
• No new test: the change replaces one random source with another, and the existing checks (sizes, EPERM, the throw, two reads that differ) pass before and after. No test I could write fails without the change on the machines I have.
• python tools/check_conventions.py --base upstream/main passes.
• CI on the fork, same steps as build.yml (run 38423102411): Windows passes; Linux passes except guest_math, which fails the same way on main's own Linux runs (for example a74f2ef, 3989003 and 7656615) and does not touch these sysctls.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes

[oneandonlydean]

Closing: no title is known to reach this. With the queue at 700+ open PRs, please hold off on new PRs that don't name a title needing the change until it's down. If a title stops on this on current main, reopen with the title ID and the log line.