Yes, we should be careful with user input.  However, tempnam() will truncate the kvm->dom string automatically (see http://linux.die.net/man/3/tempnam) so that the resulted filename can be short enough to fit the query length 255.

Shall we just comment the truncating feature of tempnam()? Or do you still prefer a code block of bounds checking as well as string truncating?