Just to note it (maybe you already noted it, maybe not), the javadoc for jsp and pld is inconsistent for this component.
It appear two properties: maxlength and for, but no property getter and setter founded on javax.faces.component.UIViewParameter.
In theory, a component that works on jsp and facelets should have the same properties. The only justification for have one property in facelet and not in jsp is some hack on its related TagHandler (really I have never seen this case), but this does not seem to be the case.
The maxlength property should not be on the viewParam tag and therefore should be removed from the following two files.
./jsf-ri/conf/share/jsf_core.tld
./jsf-ri/conf/share/facelets_jsf_core.tld
The preferred approach is to use a validator.
The for attribute on viewParam when used as a Facelets tag is
correct. It's there to support relocation of a tag in a composite
component. So you won't find a matching attribute in UIViewParameter.
However, I still have to wonder if this is even a relevant use case.
-Dan