The case of the 9 bit AES key

Several PDF implementations advertise AES-256, but generate the 256-bit key from either a very small state space, or from insecure random sources.