I thought I knew what we did for netError.xhtml and netError.dtd, but I didn't, so here's a little thing I learned today:
netError.xhtml loads 3 DTDs, one for xhtml, one is netError.dtd (global) and one is global.dtd (for RTLishness). Two boring ones, one interesting. Now, what we used to do is that browser would override the global netError.dtd (which is in the dom module) with its own version. Not anymore, global netError.dtd now imports global's netErrorApp.dtd and that is then overriden, by, guess, right, netError.dtd in browser.
Lesson learned: if you're hunting parsing errors in Firefox net error pages, you have to check both netError.dtd files for syntax errors, but not netErrorApp.dtd.