The limit isn’t the number of addresses, but the total length of the parameters, after variable substitution, passed to the application. I think it was around 255 bytes at one time but that may have changed, in response to the longer addresses produced by PJSIP_DIAL_CONTACTS.