OK, now I remember why we don't use arc4random().

bin/varnishd/mgt/mgt_cli.c

@@ -259,8 +259,9 @@ mgt_cli_challenge(struct cli *cli)
 {
 	int i;
 
+	srandomdev();
 	for (i = 0; i + 2L < sizeof cli->challenge; i++)
-		cli->challenge[i] = (arc4random() % 26) + 'a';
+		cli->challenge[i] = (random() % 26) + 'a';
 	cli->challenge[i++] = '\n';
 	cli->challenge[i] = '\0';
 	VCLI_Out(cli, "%s", cli->challenge);

bin/varnishd/mgt/mgt_main.c

@@ -316,6 +316,7 @@ make_secret(const char *dirname)
 {
 	char *fn;
 	int fd;
+	int i;
 	char buf[256];
 
 	assert(asprintf(&fn, "%s/_.secret", dirname) > 0);
@@ -326,7 +327,9 @@ make_secret(const char *dirname)
 		    dirname, strerror(errno));
 		exit(1);
 	}
-	arc4random_buf(buf, sizeof buf);
+	srandomdev();
+	for (i = 0; i < sizeof buf; i++)
+		buf[i] = random();
 	assert(sizeof buf == write(fd, buf, sizeof buf));
 	AZ(close(fd));
 	return (fn);