If there is at least one host that has no IP address set, hostname spoofing cannot work:

  def find_host_by_spoof
    ip, name = params.delete('spoof'), params.delete('hostname')
    return nil if ip.blank? && name.blank?
    @spoof = true
    Host.find_by_ip(ip) || Host.find_by_name(name)
  end

Beacause this query always succeeds:

Host::Managed Load (0.2ms)  SELECT "hosts".* FROM "hosts" WHERE "hosts"."type" IN ('Host::Managed') AND "hosts"."ip" IS NULL LIMIT 1

and returns "random" host according to the order in index or memory or whatever (SQL database magic).

Tiny little nasty bug that made me scratching my head for a LOOONG time today when I was working on puppet-unattended. I think I will fix this as this blocks my dev setup right now. So many undeletable hosts :-)