fix: TLS: check we actually have 4 bytes before skipping them