How many addresses are sent in response to a getaddr message?
The result from CAddrMan::GetAddr() is fed to CNode::PushAddress, which filters out addresses the peer already has, and inserts them in a temporary buffer of up to 1000 addresses.

Later, in SendMessages(), the contents of that buffer is sent out periodically.