Okay, now we're getting somewhere. I kind of forgot your advice about looking for the port and instead concentrated on the timestamps, which ultimately lay out a pretty clear picture of what's going on. Here's the log fragment in question:
2013-12-12 23:51:19,715 DEBUG [DiscoverySSDPMessageListener] Received a valid NOTIFY (ssdp:byebye) message from Renderer 61406566-2205-2000-0000-0017fa290807 from address /192.168.10.240:65356
2013-12-12 23:51:19,715 DEBUG [RendererManager] Removing renderer 61406566-2205-2000-0000-0017fa290807 from list of active renderers
2013-12-12 23:51:36,126 DEBUG [DiscoverySSDPMessageListener] Received a valid NOTIFY (ssdp:alive) message from Renderer 61406566-2205-2000-0000-0017fa290807 from address /192.168.10.240:31921
2013-12-12 23:51:36,126 DEBUG [RendererManager] Adding renderer Renderer [uuid=61406566-2205-2000-0000-0017fa290807, ipAddress=192.168.10.240, name=Xbox 360, profileId=3, manuallyAdded=false, forcedProfile=false, enabled=true, accessGroupId=1] to list of active renderers
2013-12-12 23:51:36,329 DEBUG [DiscoverySSDPMessageListener] Received a valid M-SEARCH message for search target uuid:d30ed390-f67e-3260-b7c0-28d9aa66601d from address /192.168.10.240:5271s
2013-12-12 23:51:36,329 DEBUG [DiscoverySearchResponder] Sending 1 M-SEARCH response message(s) to /192.168.10.240:5271
2013-12-12 23:51:36,907 DEBUG [DiscoverySSDPMessageListener] Received a valid NOTIFY (ssdp:alive) message from Renderer 61406566-2205-2000-0000-0017fa290807 from address /192.168.10.240:31921
2013-12-12 23:51:37,324 DEBUG [DiscoverySSDPMessageListener] Received a valid M-SEARCH message for search target uuid:d30ed390-f67e-3260-b7c0-28d9aa66601d from address /192.168.10.240:5271s
2013-12-12 23:51:37,325 DEBUG [DiscoverySearchResponder] Sending 1 M-SEARCH response message(s) to /192.168.10.240:5271
2013-12-12 23:51:38,325 DEBUG [DiscoverySSDPMessageListener] Received a valid M-SEARCH message for search target uuid:d30ed390-f67e-3260-b7c0-28d9aa66601d from address /192.168.10.240:5271s
2013-12-12 23:51:38,326 DEBUG [DiscoverySearchResponder] Sending 1 M-SEARCH response message(s) to /192.168.10.240:5271
2013-12-12 23:51:39,364 DEBUG [ServiioHttpService] Incoming request from /192.168.10.240:64053: GET /deviceDescription/d30ed390-f67e-3260-b7c0-28d9aa66601d HTTP/1.1, headers = [User-Agent: Xbox/2.0.16547.0 UPnP/1.0 Xbox/2.0.16547.0,Connection: Keep-alive,Host: 192.168.10.247:8895]]
2013-12-12 23:51:39,364 DEBUG [RendererDAOImpl] Reading a Renderer with ip address 192.168.10.240
2013-12-12 23:51:39,364 DEBUG [DeviceDescriptionRequestHandler] DeviceDescription request received for device d30ed390-f67e-3260-b7c0-28d9aa66601d from 192.168.10.240 (headers = [User-Agent: Xbox/2.0.16547.0 UPnP/1.0 Xbox/2.0.16547.0,Connection: Keep-alive,Host: 192.168.10.247:8895])
2013-12-12 23:51:39,364 DEBUG [RendererDAOImpl] Reading a Renderer with ip address 192.168.10.240
2013-12-12 23:51:39,364 DEBUG [RendererManager] Looking for a renderer profile for Http headers: [User-Agent: Xbox/2.0.16547.0 UPnP/1.0 Xbox/2.0.16547.0,Connection: Keep-alive,Host: 192.168.10.247:8895]
2013-12-12 23:51:39,364 DEBUG [RendererDAOImpl] Reading a Renderer with ip address 192.168.10.240
2013-12-12 23:51:39,364 DEBUG [DeviceDescriptionRequestHandler] Sending DeviceDescription XML back using profile 'Xbox 360'
So, the sequence of events:
23:51:19 - I hit "Turn off" on the 360, which promptly sends the "byebye" signal to Serviio. Serviio dutifully removes it from the active list.
23:51:36 - However, it takes the 360 a little time to fully shut down. 17 seconds later, it's stupidly still posting its status as "alive" to any interested UPnP servers. Serviio dutifully responds.
23:51:39 - Having now decided, "what the hell, may as well go full retard," the 360 tosses a GET /deviceDescription to Serviio. Again, Serviio dutifully works to respond, but by the time it's in the middle of sending the response, the 360 finally keels over dead.
And, voila. The connection to port 64053 remains hung. It's worth noting that I have another log of this process, where the hung connection's target port does NOT match the port that made the final GET call, so even in its unreliability, it's not fully reliable.
tl;dr: Stupid machine is stupid.