Difficulty: 164888818503458230623158005923420463190199545920
[830.19 Kkey/s][total 6228992][Prob 0.0%][50% in 4.365470e+033y]
But 9 characters is perfectly doable - this is on a not-all-that-beefy laptop:
Difficulty: 2988734397852220
[5.39 Mkey/s][total 75497472][Prob 0.0%][50% in 12.2y]
Moreover, it's an 'on average'. It's possible you could get a hit a split second after you call the command, and it's also possible it would take centuries to get a hit.
Note that this is if you absolutely must generate one for whatever reason. If you're talking about mining, then perhaps a 'maximum prefix' would be contingent upon profitability, in which case you'd have to consider whether the bounty equals or exceeds your expenses for vanity mining - and that is a calculation that is, again, subject to that 'on average' caveat.
The only theoretical limit is, I think, 30 (including the leading '1'), as that's when you exhaust the number of characters available in a bitcoin address to begin with.