GS4 query handler throws on short/malformed datagrams instead of dropping them

Expected Behavior

Malformed or too-short UDP datagrams sent to the GS4 query port should be silently dropped.

Actual Behavior

GameSpyQueryHandler.channelRead0 (around line 107–119) reads magic bytes, type, and sessionId via readUnsignedByte()/readByte()/readInt() without first checking readableBytes(). A datagram shorter than 7 bytes throws IndexOutOfBoundsException on every packet, caught and logged at WARNING level:

Error whilst handling query packet from <sender>

The challenge-token validation for 0x00 stat responses (line 139–143) correctly prevents reflection of the larger response — a spoofed source can't obtain a valid token. So this is just log noise and minor CPU overhead, not a reflection amplification issue.

Steps to Reproduce

1. Enable enable-query=true in velocity.toml.
2. Send a short UDP datagram to the query port:

   echo -n "x" | nc -u <proxy-ip> <query-port>
   

3. Each datagram produces a WARNING-level exception in the log.

Plugin List

N/A — core proxy code with enable-query=true.

Velocity Version

Checked at dev/3.0.0@a7581821

Additional Information

The fix is straightforward: check in.readableBytes() >= 7 (2 magic + 1 type + 4 sessionId) at the top of handleMessage and return early if the datagram is too short. This matches how the stat path already validates readableBytes() at line 146.

Start at GameSpyQueryHandler.channelRead0 and its handleMessage path, around the lines identified in the report, and compare the query handling with the existing readableBytes() check in the stat path. Verify the short-datagram case using the provided UDP reproduction; done means malformed or shorter-than-7-byte packets are dropped without an IndexOutOfBoundsException or WARNING log.