Index: ioemu/vnc.c
===================================================================
--- ioemu.orig/vnc.c	2007-05-10 15:11:41.000000000 +0100
+++ ioemu/vnc.c	2007-05-10 15:11:41.000000000 +0100
@@ -1266,7 +1266,7 @@
 
 extern int parse_host_port(struct sockaddr_in *saddr, const char *str);
 
-void vnc_display_init(DisplayState *ds, const char *arg)
+int vnc_display_init(DisplayState *ds, const char *arg, int find_unused)
 {
     struct sockaddr *addr;
     struct sockaddr_in iaddr;
@@ -1308,6 +1308,9 @@
 
     vnc_dpy_resize(vs->ds, 640, 400);
 
+    if (arg == NULL)
+	arg = "localhost:0";
+    
 #ifndef _WIN32
     if (strstart(arg, "unix:", &p)) {
 	addr = (struct sockaddr *)&uaddr;
@@ -1352,7 +1355,11 @@
 	}
     }
 
-    if (bind(vs->lsock, addr, addrlen) == -1) {
+    while (bind(vs->lsock, addr, addrlen) == -1) {
+	if (find_unused && errno == EADDRINUSE) {
+	    iaddr.sin_port = htons(ntohs(iaddr.sin_port) + 1);
+	    continue;
+	}
 	fprintf(stderr, "bind() failed\n");
 	exit(1);
     }
@@ -1366,6 +1373,8 @@
     if (ret == -1) {
 	exit(1);
     }
+
+    return ntohs(iaddr.sin_port);
 }
 
 int vnc_start_viewer(int port)
Index: ioemu/vl.c
===================================================================
--- ioemu.orig/vl.c	2007-05-10 15:11:41.000000000 +0100
+++ ioemu/vl.c	2007-05-10 15:11:41.000000000 +0100
@@ -132,6 +132,7 @@
 static DisplayState display_state;
 int nographic;
 int vncviewer;
+int vncunused;
 const char* keyboard_layout = NULL;
 int64_t ticks_per_sec;
 int boot_device = 'c';
@@ -6311,6 +6312,7 @@
            "-loadvm file    start right away with a saved state (loadvm in monitor)\n"
 	   "-vnc display    start a VNC server on display\n"
            "-vncviewer      start a vncviewer process for this domain\n"
+           "-vncunused      bind the VNC server to an unused port\n"
 #ifndef _WIN32
 	   "-daemonize      daemonize QEMU after initializing\n"
 #endif
@@ -6407,6 +6409,7 @@
     QEMU_OPTION_vcpus,
     QEMU_OPTION_acpi,
     QEMU_OPTION_vncviewer,
+    QEMU_OPTION_vncunused,
 };
 
 typedef struct QEMUOption {
@@ -6486,6 +6489,7 @@
     { "smp", HAS_ARG, QEMU_OPTION_smp },
     { "vnc", HAS_ARG, QEMU_OPTION_vnc },
     { "vncviewer", 0, QEMU_OPTION_vncviewer },
+    { "vncunused", 0, QEMU_OPTION_vncunused },
 
     /* temporary options */
     { "usb", 0, QEMU_OPTION_usb },
@@ -6853,6 +6857,7 @@
     snapshot = 0;
     nographic = 0;
     vncviewer = 0;
+    vncunused = 0;
     kernel_filename = NULL;
     kernel_cmdline = "";
 #ifdef TARGET_PPC
@@ -7272,12 +7277,15 @@
             case QEMU_OPTION_vncviewer:
                 vncviewer++;
                 break;
+            case QEMU_OPTION_vncunused:
+                vncunused++;
+                break;
             }
         }
     }
 
 #ifndef _WIN32
-    if (daemonize && !nographic && vnc_display == NULL) {
+    if (daemonize && !nographic && vnc_display == NULL && vncunused == 0) {
 	fprintf(stderr, "Can only daemonize if using -nographic or -vnc\n");
 	daemonize = 0;
     }
@@ -7553,10 +7561,11 @@
     /* terminal init */
     if (nographic) {
         dumb_display_init(ds);
-    } else if (vnc_display != NULL) {
-	vnc_display_init(ds, vnc_display);
+    } else if (vnc_display != NULL || vncunused != 0) {
+	int vnc_display_port;
+	vnc_display_port = vnc_display_init(ds, vnc_display, vncunused);
 	if (vncviewer)
-	    vnc_start_viewer(vnc_display);
+	    vnc_start_viewer(vnc_display_port);
     } else {
 #if defined(CONFIG_SDL)
         sdl_display_init(ds, full_screen);
@@ -7626,7 +7635,7 @@
         }
     }
 
-    if (vnc_display == -1) {
+    if (vnc_display == NULL && vncunused == 0) {
         gui_timer = qemu_new_timer(rt_clock, gui_update, NULL);
         qemu_mod_timer(gui_timer, qemu_get_clock(rt_clock));
     }
Index: ioemu/vl.h
===================================================================
--- ioemu.orig/vl.h	2007-05-10 15:11:41.000000000 +0100
+++ ioemu/vl.h	2007-05-10 15:11:41.000000000 +0100
@@ -928,7 +928,7 @@
 void cocoa_display_init(DisplayState *ds, int full_screen);
 
 /* vnc.c */
-void vnc_display_init(DisplayState *ds, const char *display);
+int vnc_display_init(DisplayState *ds, const char *display, int find_unused);
 void do_info_vnc(void);
 int vnc_start_viewer(int port);
 
