2.2.1 [XML] Section 2.2, Characters

V0010:

The specification states:

 [2]   Char   ::=   #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]
 /* any Unicode character, excluding the surrogate blocks, FFFE, and FFFF. */

MSXML3 and MSXML6

The processor accepts the surrogate block #xFFFE as a valid character reference.