SecureRandomBytes(count) returns independent packed BYTE data from the operating system’s cryptographic source. FillSecureRandom(BYREF bytes) replaces an existing initialized buffer with the same length. These operations are separate from PCG/RND and never fall back to a weak pseudorandom generator on failure.
Counts must satisfy the checked capacity range. Zero requests an empty result. IoError reports OS failures, including an unavailable, uninitialized or prohibited source. Allocation failure retains its separate fatal policy. Returned bytes do not form a special locked or automatically erased secure-memory type; protect their storage according to the application’s needs.
A successful result is complete. FillSecureRandom prepares replacement data before committing it, so OS failure or cancellation before commitment preserves the old buffer. Cancellation after commitment does not undo the replacement. Ordinary independent copies and deterministic cleanup still apply.
The operation cooperates with the runtime’s supported scheduling boundaries; compiled/native operations may finish before cancellation is observed at the caller. No background entropy thread or general asynchronous random stream is implied. Chapter 18 contains a checked example and distinguishes reproducible simulation randomness from secure bytes.