Key generation for curve25519/ed25519 and potential "weak" key pairs

According to RFC 8032, 5.1.5, Key Generation, key pairs are generated from a 256 bits random seed, with the lowest 3 bits cleared and the upper 2 bits set to (01). This results in values that are multiples of 8 between 2^254 and 2^255-8. Two of these values, 2^255-8 and 2^255-16, are larger than 2^255-19 and congruent to 11 and 3 respectively after modulo reduction.

The number $2^{255} - 19$ is the size of the coordinate field, which is the range of the numbers $x$ and $y$ in points $(x, y)$ that public keys represent, where $$-x^2 + y^2 \equiv 1 - \frac{121665}{121666} x^2 y^2 \pmod{2^{255} - 19}.$$ The secret random seed, in contrast, is converted by the process you cited into a scalar $s$ with $0 \leq s < 8\cdot L$, where $$L = 2^{252} + 27742317777372353535851937790883648493.$$ That is, the full range of distinct scalars is $$0 \leq s < 2^{255} + 221938542218978828286815502327069187944,$$ so the process maps the same number of inputs to each output; it is not the case that some outputs are reached from more inputs than others by reduction modulo the order of the scalar ring.

This magic number $L$ is described in RFC 8032 § 3 “EdDSA Algorithm”, parameter 10, and is shown in Table 1 at the top of RFC 8032 § 5.1 “Ed25519ph, Ed25519ctx, and Ed25519”. (In the original Curve25519 paper it is called $p_1$, and in the original Ed25519 paper it is called $\ell$.) It is the smallest number of times you can add the standard base point $B$ to itself before you get back the identity, $$\underbrace{B + \dotsb + B}_{\text{$L$ times}} = [L]B = \mathcal O.$$ The number $8\cdot L$ is the total number of points in the curve (not all of them are scalar multiples of $B$), which by Hasse's theorem is always near the size of the coordinate field but not necessarily the same.