That is correct. the CARP protocol only supports 254 unique VHIDs on a single broadcast domain.
We recently tried to bump that up to 65,536 on 2.0 but it was ... problematic.
Instead 2.0 was changed to allow you to make IP aliases on CARP VIP interfaces. So you could have multiple IPs per VHID, circumventing all limits without causing the increased network load that 65,536 CARP heartbeats per second would incur.
Thanks for the response... in all the Google-ing I did, I never found this limit documented. Let me ask you this, if the limit is 254 in a single broadcast domain, how is this limit hit when I have the FAILOVER interfaces for each pair of redundant firewalls on a separate VLAN? I also tried putting the firewalls on separate vSwitches in ESX... I assume it doesn't matter once it hits the switch? Would VLAN-ing the WAN interfaces (WAN-1, WAN-2 etc) eliminate this problem?