If a war is packaged inside an ear, the war's classloader is leaked on undeploy.

From a JBoss Profiler heap analysis of a ClassloaderLeakUnitTestCase failure:

!--BaseClassLoader@7ba4f9

{vfsfile:/C:/dev/jboss/jboss-head/testsuite/output/lib/classloader-leak-simple.ear}

!-!-FieldReference private java.lang.ClassLoader org.jboss.classloader.plugins.loader.ClassLoaderToLoaderAdapter.classLoader=BaseClassLoader@7ba4f9

{vfsfile:/C:/dev/jboss/jboss-head/testsuite/output/lib/classloader-leak-simple.ear}

!-!!-FieldReference private org.jboss.classloader.spi.Loader org.jboss.classloader.spi.ClassLoaderDomain.parent=ClassLoaderDomain@10ed39f

{vfsfile:/C:/dev/jboss/jboss-head/testsuite/output/lib/classloader-leak-simple.ear/classloader-leak-simple-ejb.war}

!-!!!-FieldReference java.lang.Object java.util.HashMap$Entry.value=vfsfile:/C:/dev/jboss/jboss-head/testsuite/output/lib/classloader-leak-simple.ear/classloader-leak-simple-ejb.war=ClassLoaderDomain@10ed39f

{vfsfile:/C:/dev/jboss/jboss-head/testsuite/output/lib/classloader-leak-simple.ear/classloader-leak-simple-ejb.war}

!-!!!!-arrayRef [Ljava.util.HashMap$Entry;[6] id=@18063131
!-!!!!!-FieldReference transient java.util.HashMap$Entry[] java.util.HashMap.table=

{..............}

, =ClassLoaderDomain@6c5482{}}
!-!!!!!!-FieldReference private java.util.Map org.jboss.classloader.spi.ClassLoaderSystem.registeredDomains=DefaultClassLoaderSystem@8b1a4

I'll create a forum thread and discuss the details of how this occurs there.