Summary

This regressed in 40dd9d9 ("ebpf: simplify get_pristine_per_cpu_record" #1091), which removed the explicit zeroing of trace->custom_labels.labels on the assumption that the slots were only read after a successful write that fully populated them. The slots are populated via bpf_probe_read_user, which only writes the bytes it reads, so a key/value shorter than one previously written to the same per-CPU slot inherits trailing bytes from the prior trace and produces a corrupted label.

• eBPF side: write a single NUL after each bpf_probe_read_user.
• Go side: validate label keys and values as UTF-8, which OTLP/pprof require. Strictness is deliberately asymmetric:
  • Keys are strict. Any invalid byte (including a single split-rune continuation at the end) drops the whole label. A corrupted key would silently group unrelated samples under a garbage name, which is worse than dropping.
  • Values are lenient. Fixed-width eBPF buffers can clip a multi-byte rune in half at the buffer boundary; we salvage the longest valid UTF-8 prefix rather than discard the label, so a clipped request_id or customer_name still arrives with everything up to the broken rune intact.
• Two new metrics (IDGoLabelsDroppedInvalidName, IDGoLabelsDroppedInvalidValue) count labels dropped for each reason.
• comm is left as best-effort: kernel-supplied, almost always ASCII, no useful fallback if it isn't.

Supersedes #1453.