Hi anonymous user , thanks for the question. All AAD B2C attribute limits can be found here. The limits are assigned to their type, unless stated otherwise. For example a "String" value character limit is 256 so userPrincipalName's limit is 256. However, surname is also a string but its limit is 64 (since it's explicitly stated).
And yes, you can create custom attributes by following this document.
Please let me know if you have any questions.
If this answer helped you please mark it as "Verified" so other users can reference it.
Thank you,
James