Thank you for your questions.
I will try to answer them without creating a very long answer and looking at the fact that I'm not a native English speaker (that may led in some misspelling and understanding issues).
I will try to simplify things and will also avoid much of the tech mambo jambo in order to produce a more readable text.
1. HDD ACCESS
PSNPatch was prepared by looking, not only at the ps3 behaviour, and transmitted packages over the net, but also over KW knowledge of the PS3 architecture and the information detailed by SONÿ in the leaked PS3 SDK.
Without being a PS3 specialist, we know that games running in the PS3, do it in a isolated and separated memory space.
PS3 Games also have dedicated and exclusively reserved hdd space under its "USRDIR" folder substructure.
For instance, an app with CID BLES0000 will have access exclusively to /dev_hdd0/game/BLES0000/USRDIR.
That is why it is so easy for developers to test if a game is running moded, because there must be changes in this folder structure.
Games have also access to save and load game progress but not through a direct dev_hdd0 access but using specific sony sdk methods and procedures.
This kind of isolation has many advantages in a modern OS as the PS3 and it is currently used by most top OS available – of course this is out of the scope of this message and it should be discussed in another topic.
Back to our scope:
With this implementation an official ps3 game can detect if it is running modded but should not be able to detect if there are illegal files in the hdd (as multiman installed and so on).
But even if there are "illegal" files, or a game has access to other areas (which I doubt for the reasons stated before - read the PS3 SDK docs ) that proves nothing: one may even be running CFW and decides to go into OFW.
I believe we all agree that his system will then be legit, and even if he does not format its PS3 hdd, all the CFW apps will remain in the disk (not working anymore, but still there).
With this I pretend to transmit the idea that the hdd contents should not pose an issue for running games detecting a running CFW.
2. MEMORY SPACE
Additionally, games are running in a limited privilege implementation, which denies them access to memory spaces outside its own, namely, LV1 and LV2, which access (trough syscalls) is needed to validate a running CFW.
PSNPatch accesses the space outside its own reserved memory space because it is unofficially (not approved or endorsed by SONÿ) compiled for a CFW environment with higher privileges linkage.
PSNPatch plugin runs with even higher privileges.
The new stealth 3 extensions runs in LV2 memory space as top ("kernel") privilege – this is the way to fully and correctly disable the syscalls, and it is only possible for the reasons stated before.
An official game running for OFW is not able to do so.
3. XMB CONTENTS
XMB contents (as app_home or install packages) are registered and configured in dev_flash and dev_flash2 (xregistry).
These are virtual file system spaces and once again for the reasons stated in 1, games should not access them.
Additionally, even in a CFW environment, higher privileges are needed to access flash, which is not available to official games.
PS:
About the tests you refer in the beginning of your message, I do not know them, and I do not know enough of the testing environment specifically used in order to even speculate about its contents, source or propose.
PPS:
OFW running environment comments are somehow speculative as KW doesn't have an official (hardware based) development kit, as I bet 99,999% of the scene developers.
PPPS:
I know some of the ideas I've written are subject of further, and more detailed discussion, and we may not all agree on them, but I believe they are consensual enough to a vast majority – PSNPatch implementation with around 2 years of success, should be the living proof of it.
Thank you for reading and I hope it is roughly understandable