I looked at GNU OATH Toolkit and it only does 6, 7, or 8 digits. http://www.nongnu.org/oath-toolkit/index.html

I looked at some other implementations and they either hard code 6 or don't check an upper bound at all :(