Hybrid Sequence:
The starting point is $\L_h$.
We can create a separate branch of the if-statement to isolate the adversary's $(h+1)$th call to $\prgsamp$. This allows us to give a name $\seed^*$ to the PRG's seed in this call. \FORMATTINGHACK{\pagebreak}
We can apply the PRF-security of $F$ to the $(h+1)$th call to $\prgsamp$. This is a three-hop maneuver that replaces calls to $F(\seed^*,\cdot)$ with a lazy random dictionary.
The condition ``if $\prftable[i]$ undefined'' is always true, because $i$ takes on distinct values. We can therefore make the body of the if-statement unconditional:
\FORMATTINGHACK{\needspace{3\baselineskip}} Now the ``if'' and ``else if'' branches behave identically: They uniformly sample a $km$-bit string. Unifying them into one branch results in $\L_{h+1}$, which completes the proof.
$\L_h$
$\prgsamp$( ):
$count := count + 1$
if $count \le {}$
$h$:
$h + 1$:
$Y \gets \bits^{km}$
return $Y$
else:
$\seed \gets \bits^\secpar$
for $i = 0$ to $k-1$:
$X_i := F(\seed, i)$
return $X_0 \| \cdots \| X_{k-1}$
$\link$
$\lib{prf-real}$
$\key \gets \bits^\secpar$
$\prfquery$($X$):
return $F(\key,X)$
$\lib{prf-rand}$
$\prfquery$($X$):
if $\prftable[X]$ undefined:
$\prftable[X] \gets \bits^\secpar$
return $\prftable[X]$