A symbol with a binding of 0x5 that is present in a .text section is assigned the class character 'T'. However, gnu-nm assigns the character '?'. I have added logic that mimics that present in GNU nm's bfd_decode_symclass() from bfd\symc.c.
See 41711.
The associated test was XFailing, but I also had to make a slight correction of the symbol names.
My immediate thought when looking at the code here was "what about STB_WEAK"? I know this is handled elsewhere, so maybe it's worth an assert that the binding isn't STB_WEAK, along with a comment explaining why it can't be here.
I also wonder about symbols in the STB_LOOS/STB_HIOS ranges STB_LOPROC/STB_HIPROC. Does GNU in these cases always emit '?'? Please add test-cases for these.