Question : What is the default gateway on a host used for?

Yes, I know you need one.
Yes, I know it's the router.

But I can't see where the default gateway IP address is used in any UDP or TCP message.

If I send to some other host on some other network, the source IP address is my host, the destination IP address is the other host. And these never change. So why do I need a default gateway (on a host)?

I can't see where the default gateway IP address is ever used. Maybe it's just, given the default gateway, assuming multiple NIC cards on the host, the NIC card that is on the same subnet as the default gateway is the NIC to use by default.

Answer : What is the default gateway on a host used for?

It's like this.  

Your PC has an IP address, a subnet mask, and a default gateway.

For the heck of it, 192.168.1.100, 255.255.255.0, and 192.168.1.0.

Layer 4 plus wants to send traffic to Experts Exchange.com and has already determined through DNS that the IP is 64.156.132.140.

Layer 3 throws the IP in for the destination and its own for the source and passes it down to layer 2.

Layer 2 gets it and needs to know where to send it.

Layer 2 will ( or if has already cached it won't) then do a binary AND operation with the IP address and subnet mask to determine the network address.  It will perform the same operation on the destination IP address.  If the two network addresses are different ... then it will check its ARP cache for the MAC ADDRESS of the DEFAULT GATEWAY.  If it doesn't have it, it will issue an ARP layer 2 broadcast to get the MAC address of the default gateway.

Once Layer 2 has the MAC for the default gateway, it will put the default gateway's MAC as the destination and put its own MAC as the source and pass it to layer 1 for transmission to the default gateway.

The default gateway will get the frame, strip layer 2 info, examine layer 3 info, consult the routing table to decide what to do with it, and if it knows a route will send it out the appropriate interface with the process above (assuming Ethernet interfaces) or if it does not know what to do with it will send it to its own default gateway - usually called a default route or gateway of last resort.  If it does not have a default gateway, and no valid route, it will drop the packet and may issue an ICMP message - destination net unreachable.

HTH