RemotingCommand.decode throws unchecked exceptions for malformed frame headers

RemotingCommand.decode reads the header marker without checking that four bytes are available and passes an unknown serialize-type code into headerDecode. Malformed frames can therefore raise IndexOutOfBoundsException or NullPointerException instead of RemotingCommandException. Expected behavior: reject short frames and unknown serialize types with a controlled decode error.

Start by locating RemotingCommand.decode and tracing its headerDecode call and existing decode-error handling. Reproduce inputs with fewer than four header bytes and with an unknown serialize-type code; done means both malformed frames produce RemotingCommandException rather than unchecked exceptions.

Written by the indexing model from the issue text.