"Context default namespace: http://www.w3.org/1999/xhtml"
"── Trigger 1: <a xmlns=""><b xmlns="">x</b><iframe …/></a> via innerHTML"
"  <a>      namespaceURI = null  (expected null)"
"  <b>      namespaceURI = null  (expected null)"
"  <iframe> namespaceURI = "http://www.w3.org/1999/xhtml"  (expected null)"
"  <iframe> constructor  = HTMLIFrameElement"
"[BUG-CONFIRMED] iframe wrongly in XHTML namespace"
"[BUG-CONFIRMED] iframe is live HTMLIFrameElement"
"── Trigger 2: <a xmlns=""><b xmlns="http://x"><c xmlns="">x</c></b><img …/></a>"
"  <img>    namespaceURI = "http://www.w3.org/1999/xhtml"  (expected null)"
"  <img>    constructor  = HTMLImageElement"
"[BUG-CONFIRMED] img wrongly in XHTML namespace"
"[BUG-CONFIRMED] img is live HTMLImageElement"
"── Trigger 3: Range.createContextualFragment → null-NS <script> becomes HTMLScriptElement"
"  <script> namespaceURI = "http://www.w3.org/1999/xhtml"  (expected null)"
"  <script> constructor  = HTMLScriptElement"
"[BUG-CONFIRMED] script wrongly in XHTML namespace"
"[BUG-CONFIRMED] script is HTMLScriptElement"
"── Control (no nesting): <a xmlns=""><b>x</b><iframe/></a>"
"  <iframe> namespaceURI = null  (expected null — and it is null ✔)"
">>> RESULT: BUG CONFIRMED — null-namespace elements were promoted into the XHTML namespace and instantiated as live HTML elements."
"[BUG-CONFIRMED] live-HTML payload fired: img onerror fired"
"[BUG-CONFIRMED] live-HTML payload fired: 127.0.0.1"