I understand that IPv6 reserves the fe80::/10 prefix for link local addresses, and that hosts select an address with a /64 prefix.
Why is the reserved space so much larger than what is actually used for link local?
I think the link-local scope was set to /10 simply to "fit in" better with the other scopes, e.g. site-local (before it was replaced with unique local).
Initially I had thought maybe it was to allow the use of many link-local networks on the same link, but RFC 4291 explicitly states that only fe80::/64 may be used.
You know, I've never considered this.
I would presume that fe80::/64 is used because systems then run stateless address autoconfiguration (SLAAC) in that /64. Leaving the rest of the /10 available for statically assigned link-local addresses and netblocks. I'm having a tough time coming up with significant use cases for static link-local assignments, but I suppose there are reasons that people might end up wanting to do so.
The design philosophy behind IPv6 is that having a reasonably-structured address space is more important than conserving addresses. Incidentally, IPv4 was conceived with the same idea (which is why each device has 16 million loopback addresses, but only ever uses the 127.0.0.1 address, and most of the class D and E addresses are unused).
Link-local addresses theoretically do waste gazillions of IP addresses, but it's not considered a problem. Similarly, giving each customer a full /56 or even /48 is technically very wasteful, but not a real problem.
There is a dark side to this approach: the claim that IPv6 can give an IP address to each grain of sand in the world (or some such) is nonsense, just as the claim that IPv4 can support 4 billion devices. In reality, by the time you add up all the waste in IPv6, you'll find that the limits are much narrower (still bigger than IPv4).
I think that it comes down to 2 things. First, a link-local cannot be routed, so no subnet ID is needed. It is assumed that since it cannot be routed that anything following the prefix up until the last 64-bits will be zero's. Second, like other similar IPv6 prefixes, the prefix is everything up until the last '1' bit. This keeps consistency.
/9
not a /10
.