>But that kernel came from neither testing nor unstable: >$ apt-cache policy linux-image-4.9.0-3-amd64 > 500 http://security.debian.org stretch/updates/main amd64 >Surely stable should have mutually compatible versions of kernel and at >least virtualbox guest tools?
there is *no* vbox in stable. rmadison -u debian virtualbox virtualbox | 4.1.42-dfsg-1+deb7u1 | oldoldstable | source, amd64, i386 virtualbox | 4.3.18-dfsg-3 | oldstable-kfreebsd/contrib | source virtualbox | 4.3.36-dfsg-1+deb8u1~bpo70+1 | wheezy-backports/contrib | source, amd64, i386 virtualbox | 4.3.36-dfsg-1+deb8u1 | oldstable/contrib | source, amd64, i386 virtualbox | 5.1.8-dfsg-6~bpo8+2 | jessie-backports/contrib | source, amd64, i386 virtualbox | 5.1.26-dfsg-2~bpo9+1 | stretch-backports-debug/contrib | source virtualbox | 5.1.26-dfsg-2~bpo9+1 | stretch-backports/contrib | source, amd64, i386 virtualbox | 5.1.26-dfsg-2 | testing/contrib | source, amd64, i386 virtualbox | 5.1.28-dfsg-1 | unstable-debug/contrib | source virtualbox | 5.1.28-dfsg-1 | unstable/contrib | source, amd64, i386 just use virtualbox in stable-backports (aka stretch-backports). 5.1.28 will go there in two/three days, as soon as it reaches Buster (aka testing). G.
