They do go through the kernel; it asks the kernel "can I use rdrand", and the kernel says "yep, go ahead, it works on this CPU". If that's not true, and it doesn't work on the CPU, then it's the kernel's fault for lying and saying that it does.