This has definitely been a known issue for awhile, frustratingly. At one point, a team I was working with had to code their own RNG replacement for OpenSSL's;

This has definitely been a known issue for awhile, frustratingly. At one point, a team I was working with had to code their own RNG replacement for OpenSSL's; the one in the codebase was behaving badly in a multithreaded environment. I don't know if the change was ever accepted back upstream; if I recall correctly, the initial response was something to the effect of "you're using it wrong" (as if multithreaded applications are some new and fascinating beast, and not increasingly just the way you do it to leverage all the performance a modern computer offers in hardware).