The NFC Forum Type 5 spec (NFCForum-TS-T5T), section 4.3, says:

The T5T_Area (i.e., memory containing the NDEF message) starts with the first byte following the last byte of the CC field. The size of the T5T_Area is defined by the content of the CC field.

So the MLEN does not include the memory occupied by the capability container itself, but includes all other memory available in the tag REGARDLESS OF THS SIZE OF THE NDEF MESSAGE.

What follows after the capability container is usually length bytes as @Andrew points out. However the more complete story is that there is an NDEF TLV (as prescribed by section 4.4 of the NFCForum-TS-T5T. The tag for the NDEF TLV is 0x03, and following that is a single length byte (for lengths <= 254) or 3 bytes indicating a longer (>=255) length. As per the spec:

The length field (L-field) encodes the size of the V-field in bytes. ... If the L-field is present, it may contain one or three bytes: One byte if the length to encode is between 00h and FEh. The value FFh for the first byte encodes a three-byte format. Three bytes if the length to encode is between 00FFh and FFFEh. The three-byte value FFFFFFFh is RFU.

So following the capability container must be a 0x03, followed by the length of the NDEF, followed by the NDEF message itself. Assuming the 3 records in total are < 255 bytes, following the capability container should be:

03 | {single byte length} | record 1 | record 2 | record 3