Ok, after playing with this for the better part of the day and stripping it down it looks like it has something to do with the ConnectionProxyHandler
It looks like when you do something like session.sessionWithOptions().connnection() you get a proxy 2 levels deep and then when the register(Statement statement) gets called the same instance of the statement ends up in 2 layers of xref maps from the JdbcResourceRegistry. When the first session closes then it invalidates the statement and then when the overall session tries to close it fails and blows out before releasing the connection and leaking it.
Here's an arbitrary snippet of code that will cause the behavior, it's 3 levels deep since I wanted to get my head wrapped around whether or not the register would be called 3 times or not (it was).
The exception that it blows gets eaten and leaks the connection, it looks like it's already been raised as a JIRA https://hibernate.onjira.com/browse/HHH-7020
I'll go and throw my 2c in.
//replace this with however you obtain a session
Session session = obtainSession();
Transaction t = session.beginTransaction();
Session secondSession = session.sessionWithOptions().connection().openSession();
Session thirdSession = secondSession.sessionWithOptions().connection().openSession();
SQLQuery sqlQuery = thirdSession.createSQLQuery("select 1 from dual");