According to section 12.5.5 of the User's manual, the WOVF bit is NOT cleared when a watchdog reset occurs. Thus, it needs to be cleared manually - or else a subsequent watchdog reset will not occur.
I see, though, that the Linux code clears it just before starting the watchdog - which is a bit cleaner than my method. I'll see if I can get that to work for me...