

I think installing spyware on someone’s device is two or three steps more drastic a measure than a simple search, which is about the extent of what a court order can authorize police to do right now. It feels conceptually close to tampering with evidence present at a (possible) crime scene. To add to this, spyware is not the same thing as installing a physical listening device in someone’s home. It requires far-reaching permissions on a system, and can influence lots of other software on the same system. You’d have to have an extreme level of confidence that this won’t lead to accidental or intentional planting of incriminating material. And, in my opinion that sort of load-bearing trust is not really something law enforcement has earned in the general case.

You’re saying one VM was cloned from the other. I could imagine a DHCP client saving leases to disk (they can have pretty long validity periods), and if the box was assigned the .106 address at any point and then cloned, the cloned machine would probably try to take that address, in other words ARP the address to determine if it’s taken, and if so, fall back to some other thing. I would have expected an APIPA address but 172.x.y.z is not out of the question depending on config.
Also, if your bridge has an interface connected to e.g. another ISP-provided router then it would expose any DHCP server running behind that interface to your VMs, creating a race.