Backdoor access to a reg inside an unnamed primitive

Our internal register doesn’t use a reg with an always block, it uses a latch ip from other companies like this:

module register(input d, e, rstb, output q);
    latch_cell u_latch(.D(d), .E(e), .rstn(rstb), .Q(q), .QN());
endmodule

`celldefine
module latch_cell (D, E, rstn, Q, QN);
    input D,E,rstn;
    output Q, QN;
    not (QN, Q);
    some_udp (Q, D, E, rstn);
endmodule
`endcelldefine

primitive some_udp(q, d, e, rstn);
    output q;
    reg q;
    input d,  e, rstn;

    table
    ...
    endtable
endprimitive

The reg variable is inside the primitive. But what is the hdl path to this reg??? The primitive inside latch_cell is unnamed.
How can I backdoor access to this reg?

You can use the Q output for backdoor read access, but you will not be able to get write access.

This a big limitation of backdoor access.

Get the other company to fix their code and the problem is solved. When someone does not provide an instance name, they are preventing you from accessing it.

How about change the module register to this:

module register(input d, e, rstb, output reg q);
    wire q_buf;
    latch_cell u_latch(.D(d), .E(e), .rstn(rstb), .Q(q_buf), .QN());

    always_comb begin
        q <= q_buf;
    end
endmodule

I guess it won’t change the synthesized result?
I would rather ask the design team to change.