This read-write INTEGER limits the number of IPv6 addresses that can be snooped under this policy at any one time, with 0 meaning no limit; per the description, once the limit is reached, a new device must wait for an existing learned address to age out before its address can be snooped. Admins use this to cap how many clients can be tracked per policy, guarding against binding-table exhaustion from address scanning or a misbehaving host. For example, setting this to 5 means only five learned IPv6 addresses are snooped under the policy simultaneously, and a sixth device is held off until one of the five ages out.