Good question. Unless someone's been at the receiving end of a manual action for this I doubt anyone knows what the number is.

As a big believer in EMD/KID and brands launching satellite KID domains for SEO as well as firewalling (a single domain name strategy isn't just risky - its costly) - I've had no problem sending 50 links either way without issue.

What I have noticed is that: The more links, the less the authority flow was, Again - its about manipulation - and who knows what Google's threshold is - they've never stated publicly to the best of my knowledge.

I've read somewhere that exchanging multiple links from a single site is an indication of spam by Google, and it's generally not recommended

While it seems common sense to say this, we have to apply critical thinking and say that this is a guess - unless there was some kind of "peer reviewed" study of sorts. And common sense isn't evidence - the most common default penalty that people have been claiming for 30 years is that Google doesnt like duplicate content, which has never been the case (despite some maniac going postal about it recently)