Hi,
i may possibly get the issue wrong, or not at all. And i have no time to experiment right now.
But... off the top of my head:
There are 2 different versions of vbox, one is proprietary, the other is open source. And they are based on the same initial source, thus sometimes can work together (like use guest additions).
The proprietary version is from Oracle and i seen it in contrib sometimes (experimental?)
The other is long standing in debian, but much older - usually -.
I am using vbox an awful lot, and after digging into this a lot initially, came to decide to ALWAYS use the proprietary version. you can add it to sources.list.d if you like. That said: after initial installation, there are a few things to prepare before being comfortable with vbox, like
uninstall eventual debian version, prepare kernel-header, build-essentials and dkms
Then install GA from ISO, dont forget to add user to vboxsf group, eject CD and reboot.
That is when its nice and cozy. :-)
good luck