In a AES-CBC + HMAC architecture, Is it secure to send a second IV in a message to a device incapable of producing satisfactory random numbers?
And what is the best way to send this IV?


CBC IVs need to be unpredictable to attackers. If you just send them along your other IV they are no longer unpredictable, hence encrypting them as well would be the way to go and should provide reasonable security.


  plain-text IV || cipher-text || HMAC-SHA256


What you are doing here is the infamous Mac-Then-Encrypt with CBC. This is a really bad idea. A really, really, really bad idea. This is the source of many attacks on TLS. Please, learn from the past mistakes done with TLS and use a pre-made authenticated encryption mode, such as EAX or CCM, or at least Encrypt-Then-Mac with CTR.