In NIST DRBGs, the potentially-attacker-controlled “m” is the “additional info” (sp? from memory). Look at how they do it. There seem to be optimized ways of doing it, mostly by using simpler keyed constructs (HMAC, HKDF). And some do other ways, also involving a random component.
