Inline JS is blocked by CSP (script-src 'self'), so onerror= will not run. But 'self' trusts same-origin scripts, and /adv/jsonp?cb= reflects your callback into a script. Chain it: <script src="/adv/jsonp?cb=alert(document.domain)"></script>.
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only