You're correct it does. Specifically I believe it uses rdrand to fill the initial SSH values when get_random is called which then proceeds to mix in stuff from

You're correct it does. Specifically I believe it uses rdrand to fill the initial SSH values when get_random is called which then proceeds to mix in stuff from the kernel pool. This avoids the problem with using xor for mixing as has been discussed before (even though that attack vector is unlikely). BoringSSL takes a similar approach with rdrand in that it mixes it using the chacha20 stream cipher. The operating system PRNG is used to generate the keys and rdrand is filtered on every call when you need a random number. I don't know what LibreSSL does (it uses chacha20 in some manner) and I'm pretty sure OpenSSL doesn't use rdrand at all unless you ask for it (in which case it will ONLY use rdrand).