Presumably using the same skynet tech it uses to look ahead and see where the rdrand is going to be xored into. I'm less familiar with precisely how linux does it, but it's not as simple as "newsecret = oldsecret ^ rdrand". The bits are scattered all to hell.

Building a "where will this rdrand go?" backdoor is harder than building a backdoor that just trawls through load addresses for various common kernels looking for the symbol table so it can poison the entropy directly.