[BoundsSafety] failure to use __ended_by on itself

[mat-c]

Following code fails

int count(char * __ended_by(p+len) p, int len)
{
        int i = 0;
        printf("size %d %d\n", __builtin_object_size(p, 0), __builtin_dynamic_object_size(p, 0));
        while(len--) {
                i+= *p++;
        }
        return i;
}

with

error: pointer arithmetic on single pointer 'p' is out of bounds; consider adding '__counted_by' to 'p'
   15 | int count(char * __ended_by(p+len) p, int len)
      |

But p is not really a single pointer. It will be a __ended_by pointer.

Is there a way to build is code by only changing code annotation ?

PS : __counted_by doesn't work, because it expect p and len to change at the same time.