Given the following event firing sequence (with namespace repairing on):

        w.writeStartDocument();
        w.writeStartElement("foo");
        w.writeNamespace("xml", XMLConstants.XML_NS_URI);
        w.writeAttribute("xml", XMLConstants.XML_NS_URI, "lang", "ja_JP");
        w.writeCharacters("Hello");
        w.writeEndElement();
        w.writeEndDocument();
        w.close();

Zephyr writes out:

  <?xml version="1.0" ?><foo xmlns:xml="http://www.w3.org/XML/1998/namespace" xmlns:xml="http://www.w3.org/XML/1998/namespace" xml:lang="ja_JP">Hello</foo>

which is a malformed document. I added a test case DoubleXmlNsGenerationTest to the Zephyr workspace for your reference.
I'm filing this bug because we found this, but it's not currently blocking JAX-WS.