xpointer fragments and []

I am failing to handle a defect report against my IRI software from an 
end user processing this URI:

http://eg.com/test.txt#xpointer(/unit[5])

This looks to me like a correct use of xpointer, but my software reports 
an illegal character in the fragment, which I take to be the [

I can't see how the RFC 3986 grammar permits it, i.e.


fragment      = *( pchar / "/" / "?" )
pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"
unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"
sub-delims    = "!" / "$" / "&" / "'" / "(" / ")"
                  / "*" / "+" / "," / ";" / "="
pct-encoded   = "%" HEXDIG HEXDIG


seems to give a complete grammar for the fragment, and does not allow [ 
or ].

Is an xpointer fragment indeed illegal in RFC 3986? (and also 3987?)

If not, what have I misunderstood?

Jeremy