This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.
In 12.2.4.69 "Tokenizing character references", under "U+0023 NUMBER SIGN (#)", the second-last para says: Return a U+FFFD REPLACEMENT CHARACTER. But this algorithm returns character tokens, not characters. Change to: Return a character token for a U+FFFD REPLACEMENT CHARACTER. or Return a U+FFFD REPLACEMENT CHARACTER character token.