Found a cause the problem. There was a behavior change in
ClassLoader.loadClass() handling byte array. As discussed in
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6434149
Adding this VM argument to client JVM preserves the backward compatible behavior of loadClass() and provides a workaround without patching JDK or WebLogic server:
-Dsun.lang.ClassLoader.allowArraySyntax=true