Find address of native function inside shared object build with fvisibility=hidden

I'm trying to understand an Android app which contains a native method named foo in class com.app.Bar

Inside class Bar there is a static clause that loads a shared object System.loadLibrary("libfoo.so") which I assume is build with -fvisibility=hidden because the only export is JNI_OnLoad, no JNIEXPORT void JNICALL Java_com_app_Bar_foo which means public native int foo does not follow the naming convention.

1. What is the process when foo is invoked ?
2. How can I extract the address of foo ? I'm familiar with Frida
3. Is there a way to output all JNINativeMethod[] methods ?

What have I tried so far ?

1. JNIAnalyzer outputs 13K lines that look like JNI_OnLoad@@Base+0x712e

2. Frida script to try to find foo address (did not work)

function intercept(address) {
    try {
        Interceptor.attach(address, {
            onEnter: function(args) {
                console.log("onEnter", address);
            },
            onLeave: function(ignored) {}
        });
    } catch (e) {
        console.error(e);
    }
}
function Main() {
    var dlopen = new NativeFunction(Module.findExportByName(null, 'dlopen'), 'pointer', ['pointer', 'int']);
    var dlsym = new NativeFunction(Module.findExportByName(null, 'dlsym'), 'pointer', ['pointer', 'pointer']);
    Process.enumerateModulesSync().forEach(function(m) {
        if (m.name === "libfoo.so") {
            console.log("Module", JSON.stringify(m));
            var handle = dlopen(Memory.allocUtf8String(m.path), 1);
            var symb = Memory.allocUtf8String("foo");
            var exports = Module.enumerateExportsSync(m.name);
            console.log(JSON.stringify({
                handle: handle,
                symb: symb,
                dlsym: dlsym(handle, symb),
                exports: exports.map(function(ex){ return ex.address + ": " + ex.name })
            }, null, 2));
            // intercept all exports
            exports.forEach(function(ex){
                intercept(ex.address);
            });
            // explicit intercept foo by known offset
            intercept(m.base.add(0x22334)); // this outputs "Error: unable to intercept function at 0x86c96328; please file a bug"
        }
    });

    console.log("sleep..");
    Thread.sleep(1.5);
    console.log("invoke", Java.use('com.clazz.foo').signToken("A".repeat(32)));
}
Java.perform(Main);

from Find address of native function inside shared object build with fvisibility=hidden