When creating a new host, Foreman tries to find a suitable IP address by, if I understand correctly, pinging all possible addresses in the defined subnet and selecting the first address from which it doesn't receive an ICMP reply. This is not always enough, especially when the found IP address belongs to a host which is not running at the time Foreman tries to determine the address.

This can also be construed as a bug: Foreman tries to update the DNS zone with a (reverse) record for the new host but will fail if such a record is already present. This happens when the IP address in question belongs to a host that is 1) not currently running, 2) has a valid DNS record and 3) is not managed by Foreman (we have quite a few hosts and devices that we can not, or do not manage via Foreman).

To counter this problem Foreman should perform the equivalent of dig -x on the IP address it chooses for the new host. Only if the result of this lookup is negative should Foreman proceed with this address. I don't see any other way of making sure an IP address is really available to use.