bpf_probe_read requires const len

This code:

#include <uapi/linux/ptrace.h>

#define DATA_LEN 100

struct string {
    unsigned int len;
    char* data;  // len bytes long, not null-terminated
};

int trace(struct pt_regs *ctx, struct string *s) {
    char data[DATA_LEN];
    unsigned len = s->len > (DATA_LEN - 1) ? (DATA_LEN - 1) : s->len;
    bpf_probe_read(&data, len, s->data);
    data[len] = '\0';
    bpf_trace_printk("%s\n", data);
    return 0;
}

fails to verify with this message:

bpf: Permission denied
0: (79) r6 = *(u64 *)(r1 +112)
1: (b7) r8 = 0
2: (63) *(u32 *)(r10 -116) = r8
3: (bf) r1 = r10
4: (07) r1 += -116
5: (b7) r2 = 4
6: (bf) r3 = r6
7: (85) call bpf_probe_read#4
8: (b7) r7 = 99
9: (61) r1 = *(u32 *)(r10 -116)
10: (25) if r1 > 0x63 goto pc+7
 R0=inv R1=inv,min_value=0,max_value=99 R6=inv R7=imm99,min_value=99,max_value=99 R8=imm0,min_value=0,max_value=0 R10=fp
11: (63) *(u32 *)(r10 -120) = r8
12: (bf) r1 = r10
13: (07) r1 += -120
14: (b7) r2 = 4
15: (bf) r3 = r6
16: (85) call bpf_probe_read#4
17: (61) r7 = *(u32 *)(r10 -120)
18: (7b) *(u64 *)(r10 -128) = r8
19: (07) r6 += 8
20: (bf) r1 = r10
21: (07) r1 += -128
22: (b7) r2 = 8
23: (bf) r3 = r6
24: (85) call bpf_probe_read#4
25: (79) r3 = *(u64 *)(r10 -128)
26: (bf) r6 = r10
27: (07) r6 += -112
28: (bf) r1 = r6
29: (bf) r2 = r7
30: (85) call bpf_probe_read#4
R2 min value is negative, either use unsigned or 'var &= const'

Changing the second argument to something const (e.g. DATA_LEN) verifies.

Start with the supplied C reproducer and verifier log, comparing the variable-length bpf_probe_read call with the DATA_LEN version that verifies. Trace the verifier behavior for the second argument and confirm the issue is resolved when the original bounded-length use case verifies without weakening the intended bounds.