This is not a good way to generate "secure" random numbers, and the "visits every possible state" is not a good metric. Computing the cryptographic hash of a 1

This is not a good way to generate "secure" random numbers, and the "visits every possible state" is not a good metric. Computing the cryptographic hash of a 1536-bit counter will have better properties (and less handwaving) than this function.