The download site states that the binaries are released under the terms of the GPL. Just the oracle extension pack is released under PUEL. Reproducible: Always Steps to Reproduce:
You might be right for the -bin package (I gotta check that though) but not for the -additions package. We use the ISO image provided by Oracle and AFAIK this is still distributed under the PUEL license as it also contains closed source binaries (like the drivers for Microsoft Windows guest systems).
The file for virtualbox-additions is the same file as contained in the binary file. So if I understand this sentence correctly on the download site: The binaries are released under the terms of the GPL and the Extension Pack binaries are released under the VirtualBox Personal Use and Evaluation License (PUEL). But you are right, if there are closed source parts, it cannot be GPL. However I'm not sure what's inside src/VBox/Additions. I thought this is the source code of the binaries the iso file.
Alright, I added GPL-2 as license to virtualbox-bin-4.0.0-r1. But PUEL license must stay for now as the current 4.0.0-r1 ebuild also installs Oracle's extpack which is definitely PUEL licensed.