diff --git a/src/browser/tests/element/html/ol.html b/src/browser/tests/element/html/ol.html
index 8036e470..f999f80f 100644
--- a/src/browser/tests/element/html/ol.html
+++ b/src/browser/tests/element/html/ol.html
@@ -46,6 +46,6 @@
     testing.expectEqual('1', ol1.type);
 
     const ol2 = document.getElementById('ol2');
-    testing.expectEqual('', ol2.type);
+    testing.expectEqual('1', ol2.type);
   }
 </script>
diff --git a/src/browser/tests/element/html/tablecell.html b/src/browser/tests/element/html/tablecell.html
index d1667288..5070ceeb 100644
--- a/src/browser/tests/element/html/tablecell.html
+++ b/src/browser/tests/element/html/tablecell.html
@@ -18,6 +18,14 @@
 
     const td2 = document.getElementById('td2');
     testing.expectEqual(1, td2.colSpan);
+
+    // colSpan 0 clamps to 1
+    td2.colSpan = 0;
+    testing.expectEqual(1, td2.colSpan);
+
+    // colSpan > 1000 clamps to 1000
+    td2.colSpan = 9999;
+    testing.expectEqual(1000, td2.colSpan);
   }
 </script>
 
@@ -31,5 +39,13 @@
 
     const td2 = document.getElementById('td2');
     testing.expectEqual(1, td2.rowSpan);
+
+    // rowSpan 0 is valid per spec (span remaining rows)
+    td2.rowSpan = 0;
+    testing.expectEqual(0, td2.rowSpan);
+
+    // rowSpan > 65534 clamps to 65534
+    td2.rowSpan = 99999;
+    testing.expectEqual(65534, td2.rowSpan);
   }
 </script>
diff --git a/src/browser/webapi/element/html/OL.zig b/src/browser/webapi/element/html/OL.zig
index 7001ae24..78baf5a9 100644
--- a/src/browser/webapi/element/html/OL.zig
+++ b/src/browser/webapi/element/html/OL.zig
@@ -56,7 +56,7 @@ pub fn setReversed(self: *OL, value: bool, page: *Page) !void {
 }
 
 pub fn getType(self: *OL) []const u8 {
-    return self.asElement().getAttributeSafe(comptime .wrap("type")) orelse "";
+    return self.asElement().getAttributeSafe(comptime .wrap("type")) orelse "1";
 }
 
 pub fn setType(self: *OL, value: []const u8, page: *Page) !void {
diff --git a/src/browser/webapi/element/html/TableCell.zig b/src/browser/webapi/element/html/TableCell.zig
index b8ddccca..d57b70ff 100644
--- a/src/browser/webapi/element/html/TableCell.zig
+++ b/src/browser/webapi/element/html/TableCell.zig
@@ -21,7 +21,9 @@ pub fn asNode(self: *TableCell) *Node {
 
 pub fn getColSpan(self: *TableCell) u32 {
     const attr = self.asElement().getAttributeSafe(comptime .wrap("colspan")) orelse return 1;
-    return std.fmt.parseUnsigned(u32, attr, 10) catch 1;
+    const v = std.fmt.parseUnsigned(u32, attr, 10) catch return 1;
+    if (v == 0) return 1;
+    return @min(v, 1000);
 }
 
 pub fn setColSpan(self: *TableCell, value: u32, page: *Page) !void {
@@ -31,7 +33,8 @@ pub fn setColSpan(self: *TableCell, value: u32, page: *Page) !void {
 
 pub fn getRowSpan(self: *TableCell) u32 {
     const attr = self.asElement().getAttributeSafe(comptime .wrap("rowspan")) orelse return 1;
-    return std.fmt.parseUnsigned(u32, attr, 10) catch 1;
+    const v = std.fmt.parseUnsigned(u32, attr, 10) catch return 1;
+    return @min(v, 65534);
 }
 
 pub fn setRowSpan(self: *TableCell, value: u32, page: *Page) !void {