Here’s what the reference guide says about get_reg_by_offset():
get_reg_by_offset
virtual function uvm_reg get_reg_by_offset( uvm_reg_addr_t offset,
bit read = 1 )
Get register mapped at offset:
Identify the register located at the specified offset within this address map for the specified type of access. Returns null if no such register is found.
The model must be locked using uvm_reg_block::lock_model() to enable this functionality.
Is it possible you didn’t call lock_model() on reg_model.s1 or s2?