Cryptographic weakness on Debian systems

I don't think it was completely uninitialized.
If it is, then it was a really bad idea, as there should be no expectation that it have any
useful entropy any more than you should expect it to be filled with zeros.

Plus, a C program which does that is buggy -- you can't read memory you haven't initialized.
Sure it mostly worked, but it is still a bug.

(Not that any of that excuses the "fix" applied.)