Looking at the disassembly, you can see that the PID rerolls are generated by a different function, sub_296154, not a call to gfl2::math::Random::Next as is used for all the other egg values. Although it does look like sub_296154 is a **second** TinyMT, so I guess I was wrong about it using the game's main Mersenne Twister. Remains to be seen whether it can be manipulated or not.

Code:

int __fastcall sub_296154(int a1)
{
int v1; // r3@1
int v2; // r2@1
int v3; // r5@1
int v4; // r1@1
int v5; // r6@1
int v6; // r12@1
unsigned int v7; // r2@1
v1 = *(_DWORD *)(a1 + 4);
v2 = *(_DWORD *)(a1 + 8);
v3 = *(_DWORD *)a1 & 0x7FFFFFFF ^ v1 ^ v2 ^ 2 * (*(_DWORD *)a1 & 0x7FFFFFFF ^ v1 ^ v2);
v4 = *(_DWORD *)(a1 + 12) ^ v3 ^ (*(_DWORD *)(a1 + 12) >> 1);
v5 = -(v4 & 1);
v6 = *(_DWORD *)(a1 + 16) & v5 ^ v2;
v7 = *(_DWORD *)(a1 + 20) & v5 ^ v3 ^ (v4 << 10);
*(_DWORD *)(a1 + 12) = v4;
*(_DWORD *)(a1 + 8) = v7;
*(_DWORD *)a1 = v1;
*(_DWORD *)(a1 + 4) = v6;
return (v1 + (v7 >> 8)) ^ v4 ^ -((v1 + (v7 >> 8)) & 1) & *(_DWORD *)(a1 + 24);
}

vs. the TinyMT function used for all other egg values

Code:

unsigned int __fastcall gfl2::math::Random::Next(gfl2::math::Random *this, unsigned int a2)
{
int v2; // r12@1
int v3; // r3@1
int v4; // r5@1
int v5; // r2@1
int v6; // r6@1
int v7; // r5@1
int v8; // r4@1
int v9; // lr@1
v2 = *((_DWORD *)this + 1);
v3 = *((_DWORD *)this + 2);
v4 = *(_DWORD *)this & 0x7FFFFFFF ^ v2 ^ v3 ^ 2 * (*(_DWORD *)this & 0x7FFFFFFF ^ v2 ^ v3);
v5 = *((_DWORD *)this + 3) ^ v4 ^ (*((_DWORD *)this + 3) >> 1);
v6 = -(v5 & 1);
v7 = v4 ^ (v5 << 10);
v8 = *((_DWORD *)this + 5) & v6;
v9 = *((_DWORD *)this + 4) & v6 ^ v3;
*((_DWORD *)this + 3) = v5;
*((_DWORD *)this + 2) = v8 ^ v7;
*(_DWORD *)this = v2;
*((_DWORD *)this + 1) = v9;
return ((v2 + ((v8 ^ (unsigned int)v7) >> 8)) ^ v5 ^ -((v2 + ((v8 ^ (unsigned int)v7) >> 8)) & 1) & *((_DWORD *)this + 6))
% a2;
}