Reading https://extranet.atlassian.com/display/CONFDEV/2010/08/04/Autocomplete+Components+for+Confluence, it seems to me data-max should limit the number of search results returned.

From my findings, it seems that data-max is respected all the way till the AJAX call for content names (the value of the data-max attribute gets sent as a request parameter named "data-max"). However, the REST service ignores the parameter specified by the AJAX request.

https://svn.atlassian.com/svn/private/atlassian/confluence/trunk/confluence-rest/confluence-rest-plugin/src/main/java/com/atlassian/confluence/plugins/rest/resources/SearchService.java

Looks like the method that handles content name searches isn't expecting a "data-max" query parameter?