I'm really not competent since I never looked into details how Harmattan (closed blob lockscreen) works, but I'd suspect your only option _is_ reflashing. You should try to find the same version/revision-number of flash image as you got on your N950, so you don't 'upgrade', since Harmattan blocks downgrade. This means you can't flash an older than recently flashed image, and when you flash a newer image, you're one step closer to "dead end", Maybe http://maemo.cloud-7.de/950/myimages/ helps with that (OCF = One Click Flasher).
[edit] the whole purpose of device security lockcode and lockscreen is that you *cannot* bypass it (depending on manuffacturer's policy maybe except by a full reflash so the user data would stay private). If you could bypass (and access user private data) it would mean that the security folks in Nokia sw development did a poor job. The only other alternative to a) flashing and to b) hoping for an exploit that allows cracking the code (which I'm not aware of any for Harmattan, but see above about my competence) is: c) build some setup that tests all 99999 possible lockcodes.

Compare the infamous recent case US authorities against Apple, to unlock an iPhone. Actually Apple also wouldn't really have a way to do that, just like Nokia wouldn't (or rather: isn't supposed to) have a way to unlock N9(50) while preserving user data (let alone that there are known attack vectors independant of OS to access the user data via exploit / rooting of the modem radio firmware stack, but those are not working on N9(50) unlike on basically all more modern smartphones)