Speaking about the userspace crossing, you surely know that in OpenvSwitch only the first packet in a flow hits the user space. Based on that one, a datapath flow is created in kernel space and all subsequent traffic matching the flow goes directly through kernel space. If you haven't tried already, look closer at ovs-dpctl, particularly the show and dump-flows subcommands. I'm sure you will find any flow that passes through the patch ports there.