Surely the regular Dock uses some hidden API. Could you try to trace it?

Having failed that, I'd look into trying to inspect (if possible, even we have to disable SIP) the dock itself. Have it do the work for us and read out its badges.

(Throwing random ideas out there, I'm sure you've thought of this)