diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 595959384b..adb596edd5 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -10559,14 +10559,13 @@ verify(((VIR_DOMAIN_XML_INTERNAL_STATUS |
 
 /* This internal version can accept VIR_DOMAIN_XML_INTERNAL_*,
  * whereas the public version cannot.  Also, it appends to an existing
- * buffer, rather than flattening to string.  Return -1 on failure.  */
-static int
+ * buffer (possibly with auto-indent), rather than flattening to string.
+ * Return -1 on failure.  */
+int
 virDomainDefFormatInternal(virDomainDefPtr def,
                            unsigned int flags,
                            virBufferPtr buf)
 {
-    /* XXX Also need to take an indentation parameter - either int or
-     * string prefix, so that snapshot xml gets uniform indentation.  */
     unsigned char *uuid;
     char uuidstr[VIR_UUID_STRING_BUFLEN];
     const char *type = NULL;
@@ -11056,8 +11055,10 @@ static char *virDomainObjFormat(virCapsPtr caps,
         ((caps->privateDataXMLFormat)(&buf, obj->privateData)) < 0)
         goto error;
 
+    virBufferAdjustIndent(&buf, 2);
     if (virDomainDefFormatInternal(obj->def, flags, &buf) < 0)
         goto error;
+    virBufferAdjustIndent(&buf, -2);
 
     virBufferAddLit(&buf, "</domstatus>\n");
 
@@ -12074,7 +12075,12 @@ char *virDomainSnapshotDefFormat(char *domain_uuid,
         virBufferAddLit(&buf, "  </disks>\n");
     }
     if (def->dom) {
-        virDomainDefFormatInternal(def->dom, flags, &buf);
+        virBufferAdjustIndent(&buf, 2);
+        if (virDomainDefFormatInternal(def->dom, flags, &buf) < 0) {
+            virBufferFreeAndReset(&buf);
+            return NULL;
+        }
+        virBufferAdjustIndent(&buf, -2);
     } else {
         virBufferAddLit(&buf, "  <domain>\n");
         virBufferAsprintf(&buf, "    <uuid>%s</uuid>\n", domain_uuid);
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index 2119b5a71f..8ef9d46b35 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -1683,6 +1683,9 @@ int virDomainDefAddImplicitControllers(virDomainDefPtr def);
 
 char *virDomainDefFormat(virDomainDefPtr def,
                          unsigned int flags);
+int virDomainDefFormatInternal(virDomainDefPtr def,
+                               unsigned int flags,
+                               virBufferPtr buf);
 
 int virDomainCpuSetParse(const char **str,
                          char sep,
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index a545f1b1b3..8a6e8d30cf 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -267,6 +267,7 @@ virDomainDefCheckABIStability;
 virDomainDefClearDeviceAliases;
 virDomainDefClearPCIAddresses;
 virDomainDefFormat;
+virDomainDefFormatInternal;
 virDomainDefFree;
 virDomainDefParseFile;
 virDomainDefParseNode;
diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
index ac65459377..decb0f2623 100644
--- a/src/qemu/qemu_migration.c
+++ b/src/qemu/qemu_migration.c
@@ -384,12 +384,12 @@ static void qemuMigrationCookieGraphicsXMLFormat(virBufferPtr buf,
 }
 
 
-static void qemuMigrationCookieXMLFormat(virBufferPtr buf,
-                                         qemuMigrationCookiePtr mig)
+static int
+qemuMigrationCookieXMLFormat(virBufferPtr buf,
+                             qemuMigrationCookiePtr mig)
 {
     char uuidstr[VIR_UUID_STRING_BUFLEN];
     char hostuuidstr[VIR_UUID_STRING_BUFLEN];
-    char *domXML;
     int i;
 
     virUUIDFormat(mig->uuid, uuidstr);
@@ -422,14 +422,17 @@ static void qemuMigrationCookieXMLFormat(virBufferPtr buf,
 
     if ((mig->flags & QEMU_MIGRATION_COOKIE_PERSISTENT) &&
         mig->persistent) {
-        domXML = virDomainDefFormat(mig->persistent,
-                                    VIR_DOMAIN_XML_INACTIVE |
-                                    VIR_DOMAIN_XML_SECURE);
-        virBufferAdd(buf, domXML, -1);
-        VIR_FREE(domXML);
+        virBufferAdjustIndent(buf, 2);
+        if (virDomainDefFormatInternal(mig->persistent,
+                                       VIR_DOMAIN_XML_INACTIVE |
+                                       VIR_DOMAIN_XML_SECURE,
+                                       buf) < 0)
+            return -1;
+        virBufferAdjustIndent(buf, -2);
     }
 
     virBufferAddLit(buf, "</qemu-migration>\n");
+    return 0;
 }
 
 
@@ -437,10 +440,14 @@ static char *qemuMigrationCookieXMLFormatStr(qemuMigrationCookiePtr mig)
 {
     virBuffer buf = VIR_BUFFER_INITIALIZER;
 
-    qemuMigrationCookieXMLFormat(&buf, mig);
+    if (qemuMigrationCookieXMLFormat(&buf, mig) < 0) {
+        virBufferFreeAndReset(&buf);
+        return NULL;
+    }
 
     if (virBufferError(&buf)) {
         virReportOOMError();
+        virBufferFreeAndReset(&buf);
         return NULL;
     }