And to answer my own question...
JNP runs on 1099 in 'ports-default'. RMI is running on 1098, hence the hanging. I assumed that the same port used for (RMI) JMX access would be where shutdown requests are sent. If I had watched more closely on server startup, I would have seen this:
09:19:12,286 INFO [NamingService] Started jndi bootstrap jnpPort=1099, rmiPort=1098, backlog=50, bindAddress=/0.0.0.0, Client SocketFactory=null, Server Socket Factory=org.jboss.net.sockets.DefaultSocketFactory@ad093076