Entropy Requirements for Encryption
For example, assume an RNG spits 128-bit values $X$ that are all-zero with odds $p=1/120$, and otherwise independent and evenly distributed among the other values. The 128-bit values spit by this RNG contain $H(X)=-p\log_2(p)-(1-p)\log_2\big((1-p)/(2^{128}-1)\big)&gt;127$ bits of entropy. 

Yet, if repeatedly the same secret is XOR-ed with this RNG forming 128-bit ciphertext blocks, the secret can be recovered, with overwhelming odds, as the first value that repeats; and there are better than even odds that this occurs with a mere 250 ciphertexts.



Another example would be a 128-bit RNG where each bit is independent with odds $p=9/20$ to be one, for $H(X)=-128\big(p\log_2(p)+(1-p)\log_2(1-p)\big)&gt;127$ bits of entropy.

With the same hypothesis as in the first example, the secret can be recovered by keeping the most frequent bit value for each rank. Few hundred ciphertexts are enough to recover the secret with fair odds.

Note: the generator of the second example is still safe to generate AES-128 keys; while the first is disastrous; which illustrates that entropy is not the only thing that matters for a RNG.