At least for replication, check the checksum if the RDB version is one with final CRC64, and only later load the RDB file if it looks sane.

It should be possible to independently disable the checksum verification, like that:

pre-verify-rdb-checksum [always|replication|startup|no]

That's a 2.6 backport candidate.