As stated in Compact Font File specification:
The charset data, although in the same format as non-CIDFonts, will represent CIDs rather than SIDs, i.e. charstrings are “named” by CIDs in a CIDFont.
Unfortunately, CFFParser does not consider this specific and always treat charset data as SID: is looking for SID referenced text in String INDEX structure. Since such SID-indexed string does not exist there, it sets the name of the glyph to ".ndef".
Consequently, CFFParser fails to register correct charstrings, as it associates glyph names to them using a map. As there can be several charstrings, only the last charstring entry is retained.
Then also CFFFont.getWidth() method fails to return correct width of the given CID as correct link between CID and charstring is lost.