Even reversing the silicon won't likely help— and, uhh. Reversing a state of the art CPU is not do-at-home stuff.
The reason it won't help is that the design is _explicitly_ microcoded. E.g. RDRAND triggers running loadable microcode which is supposed to read the real RNG and AES it. Maybe there is an unrelated "bug" that allows that microcode to be corrupted after some particular instruction sequence happens. All your investigation would turn up everything looking like normal.
It looks like the microcode is also encrypted. But perhaps that encryption could be reverse engineered from silicon? The Silicon Zoo tutorial noted that Pentium I-era chips were "easily viewable" [1], probably with optical microscopes. So perhaps some parts of some newer Intel processors can be done at home. So, the "plan of attack" (ha!):
* decap an Intel CPU and scan it
* decode the microcode encryption
* figure out how the hardware RNG works with the microcode (it's AES? ok.)
* and then analyzing the system of microcode and hardware for robustness and security.
Yeah, this is hand-wavey and probably incredibly implausible. But it seems like an interesting and challenging project or three.
