Is AES-GCM length extension attack possible using authenticated decryption?
I did some more research and yes it does include both AD length and ciphertext length, so is not vulnerable to a length extension attack as length is part of GCM GHASH.

Based on NIST SP-800-38D (PDF) page 18 len(A) and len(C) are both part of the input into the GHASH function.

And double-checked this in an implementation gcm_finish method: both lengths are added to the hash at the very end.
https://github.com/polarssl/polarssl/blob/master/library/gcm.c