How are the Length and Pointer fields filled in the Record route option?

I have trouble understanding two things about RFC791:

  • First, could the base value 10 of the length be greater than 40? (the header without options is 20 bytes and HLEN is 15 maximum)? What does "length-3" mean in the following sentence?

The second octet is the length of the option that includes the option type code and the length octet, the pointer octet and length-3 octets of route data.

  • Second, is the data space allocated to this option from the datagram payload or from the header? If it's from the header, does that mean the Record route option could record a maximum of 9 addresses (36 bytes + 4 bytes, the option itself)? I've also seen some sources that say the length is 8 bits, which means a maximum length of 256 bytes, isn't it too much? Of course, it is not mentioned in the RFC.