I resolved this.
I used the "-clent" switch too (I read somewhere that -server does not collect from the PermGen, or something along the lines). But the real problem was having my jdbc driver inside the war file. I placed that in <domainDir>/lib/ext and the leak was gone.
(previously, the instance of the driver that existed in java.sql.DriverManager was created by the web app classloader, thus that classloader was referenced from the classloader that loaded DriverManager itself, preventing collection).
[Message sent by forum member 'andreou' (andreou)]
http://forums.java.net/jive/thread.jspa?messageID=281359