graphic: 0.927
network: 0.834
device: 0.799
socket: 0.759
mistranslation: 0.506
vnc: 0.472
debug: 0.469
files: 0.466
risc-v: 0.460
arm: 0.430
ppc: 0.404
register: 0.402
PID: 0.395
kernel: 0.382
architecture: 0.377
TCG: 0.367
boot: 0.330
i386: 0.320
semantic: 0.276
x86: 0.272
hypervisor: 0.267
user-level: 0.250
permissions: 0.245
VMM: 0.219
virtual: 0.199
performance: 0.191
peripherals: 0.187
assembly: 0.155
KVM: 0.145

SLIRP hostfwd ignores bind address and uses `INADDR_ANY`
Description of problem:
When using `-netdev hostfwd=`..., qemu SLIRP uses `INADDR_ANY` instead of any bind address provided by the user. As a result, even if the user specifies to listen only on localhost (e.g. `-netdev user,hostfwd=tcp:127.0.0.1:22-:22`), qemu will listen on `*.*`. This is a potential security issue (as it may unexpectedly expose the guest to internet or local network traffic).
Additional information:
The bug is here: https://gitlab.com/qemu-project/qemu/-/blob/master/net/slirp.c#L777

Rather than hardcoding `INADDR_ANY`, qemu should respect the user-defined bind address.