Seems I’d mistaken the optional libscrypt as a drop-in replacement for the included bcrypt, which it is not. HAVE_LIBSCRYPT=y do “Turn on scrypt KDF support”, but the included bcrypt code is still used (and that requires arc4random_buf()).
That means that, AFAICT, we’re stuck, as there’s no arc4random functionality currently available for user-space code (see topic: Arc4random, where are you?).
Helping with that is far above my limited skills so… sorry for not being of more help with kc. 