There’s also a strict argument to zip that might be appropriate (would cause a hard failure - need to check if that’s appropriate here).
Instead of dns_resolved + dns_resolved, you might be looking for chain cycle:
for vm_nameserver, dest in zip(qubesdb_dns, cycle(dns_resolved)) # untested
Looks like another good reason for code auditing - this is the sort of defect we could expect a non-specialist to catch.
I agree this shouldn’t wait for the bigger solution, and also with the suggestion to move other parts of the code away from the magic number 2.