Of course given that addresses are 32 bits the probability of finding a zero is also very tiny even before the stochastic host probing kicks in. However the issue of the physical origin of randomness is not gone and I cannot expect all the bits to remain randomly distributed. However if one was to consider a way to implement this is we could consider having one macro cell RAM with a 16Kb address range in which all addresses are in a random state. It would mean that a DMA operation could use a pattern to write the address to that RAM and it would be possible to specify the destination address of those 32K RAM locations. Once the RAM is full with the pattern to write a MAC would give a destination address which could then be broadcasted with a suitable MAC. We could then have a very short MAC that is the destination address written to the RAM, a 16 bit pattern to load the MAC into the correct bit fields and another step to write MAC to the RIS memory. Overall this would be very fast and make brute force attacks within the 16Kb range of the RAM more effective than a brute force attack on the remaining RAM.
However it seems that the answer currently is to simply let the host decide for itself perhaps by letting all the bits be in a random state and probing every few hundred milliseconds until it finds a set of zeros. 7211a4ac4a