The new DRBG API includes a define for RAND_DRBG_USED_FLAGS in the public header file. This is problematic for ABI compatibility. It seems to imply that we can't add new flags in ABI compat releases. If we do applications compiled against a previous release will not be using the correct value if linking at run time against a newer OpenSSL version with a different value for this define.