You wouldn't XOR-combine, you would hash them together. Something like: SHA256(32B from HWRNG-A || 32B from HWRNG-B) still guarantees you 32 bytes of entropy

You wouldn't XOR-combine, you would hash them together. Something like: SHA256(32B from HWRNG-A || 32B from HWRNG-B) still guarantees you 32 bytes of entropy if either HWRNG-A or HWRNG-B is compromised, and if HWRNG-A and HWRNG-B are both partially compromised you also get 32 bytes of entropy. XOR has weird failure modes (eg if HWRNG-A and HWRNG-B are correlated).