The br_table operator is specified in AstSemantics as taking one expression that yields a value for the exited construct. This matches the spec as implemented ml-proto.
But BinaryEncoding says that br_table takes just one expression as input (the key), and doesn't mention this additional expression for the break value. AFIAK all the browser implementations match this, or they wouldn't be able to run the AngryBots wasm file.