Ok, there's indeed something that relates to endpoint. I understand that you use two bytes located within the USB RAM space to get the TX and RX reports.

BD1STATOUT = _USBMEMORYADDRESS + 8 ; 408h or 208h
BD1STATIN = _USBMEMORYADDRESS + 0Ch ; 40Ch or 20Ch
Now I'm clueless about what this refers to... tried to look at the hid_desc.pbp/asm code and compare it with cdc_desc.pbp/asm, and also to look on the net for RAM endpoint allocation at these two address but no luck so far