The HID report descriptor is supplied dynamically by tud_hid_descriptor_report_cb(), but the length is not passed back. The report descriptor does not include its own length. The length has to have been set previously in p_hid->report_desc_len. It is set in hidd_open(), since the length must be set in the HID descriptor (not the HID report descriptor).
I am not sure what the utility of this callback is, then. You could substitute an HID Report Descriptor of identical length, but that's all. Maybe I am missing something.