In the RSA algorithm, we choose $p$ and $q$ as prime numbers and we select a value $e$ which is coprime to $\varphi(pq)=(p-1)(q-1)$.
Then we calculate $d:=e^{-1}\bmod\varphi(pq)$.
My question is: What could be the maximum value of $d$? Is there an upper bound to it?
If $d$ is a valid RSA decryption exponent, then so is $d \pm k \lambda(pq)$ for any integer $k$.
As a corollary, we may always choose the decryption exponent to lie in the range $0 < d < \lambda(pq)$. In fact, there's generally no reason to choose the decryption outside that range: a larger exponent would just make decryption slower, while using a negative exponent would require computing a modular inverse (which is even slower yet).
Thus, in practice, pretty much all RSA decryption exponents are positive integers less than $\lambda(pq) = \operatorname{lcm}(p-1, q-1)$, or at least less than $\varphi(pq) = (p-1)(q-1)$.
Further, since $\lambda(pq) \le \varphi(pq) < pq = n$, it follows that a normal (i.e. not deliberately chosen to be unnecessarily large) RSA decryption exponent is always (positive and) smaller than the modulus $n$.
Mathematically speaking, there is no upper bound on the private exponent in RSA: assuming $d$ is a valid private exponent, then the valid exponents are the set of $d'=d+k\cdot\lambda(p\cdot q)$ with $k\in\mathbb Z$, where $\lambda(p\cdot q)=\operatorname{lcm}(p-1,q-1)$ since $p$ and $q$ are distinct primes; this set is unbounded.
If you compute $d$ as an integer with $d\equiv e^{-1}\pmod{\varphi(p\cdot q)}$, then by definition $d$ verifies $e\cdot d-1$ multiple of $\varphi(p\cdot q)$, and is unbounded. If you compute $d$ as the integer $d=e^{-1}\bmod\varphi(p\cdot q)$, by a common definition of that notation, $d$ is additionally non-negative and less than $\varphi(p\cdot q)$, which is then an upper bound.
In practice, available memory and time, existing software, or standards, limit the value of $d$. A most common standard, PKCS#1, requires $0<d<n$; the FIPS 186-4 standard requires $2^{\lceil\log_2(N)\rceil/2}<d<\operatorname{lcm}(p-1,q-1)$; some implementations allow $0<d<256^{\lceil\log_{256}(p\cdot q)\rceil}$; $d\ge\varphi(p\cdot q)$ is unusual.
Aside from being pedantic and telling you that you can choose arbitrarily large $d$ in some congruence class, you can always achieve $d\equiv -1 \bmod \phi(pq)$ by choosing $e$ to be the same.
So in the interval $[1,\phi(pq)]$ the largest $d$ could be is $\phi(pq)-1$.
