Vagrant port forwarding binding interfaces and auto-correction behavior

By default, Vagrant binds forwarded ports to all available interfaces (0.0.0.0). This configuration potentially exposes guest services to the local area network or the internet unless the host is explicitly restricted. While setting the host parameter to 127.0.0.1 in the Vagfile mitigates this risk, it limits access to the localhost only.

The complexity increases in multi-machine environments where multiple guests attempt to bind to the same host port. Although Vagrant offers an auto_correct: true setting to resolve collisions by incrementing the host port, this behavior creates non-deterministic environments where the host port may change unexpectedly between boot cycles.

How does Vagrant determine the specific offset logic when auto-correction is triggered in a multi-machine Vagfile, and is there a mechanism to enforce a specific host binding while still allowing automated collision resolution for the guest port?