We allow hexadecimal numeric character references to be at most 8 digits length. However, the current Unicode specification limits its allocation range up to U+10FFFF inclusive. This restriction is due to UTF-16 encoding's structure and will not be relaxed. A collateral evidence is that RFC3629 is defined as such.

So 8 is too much; 6 is enough. Also, 0x10FFFF== 1,114,112 so 8 digits in decimal character references are too much too; 7 is enough.