The attached testcase illustrates a font that once imported has 7 code points (that I know of) that are 'true' according to isCharDefined() even though they aren't actually implemented by the font. Furthermore, 6 of the characters (Yacute, yacute, Thorn, thorn, Eth and eth) actually render to the wrong glyph. The seventh (hyphen) renders to the 'notdef' glyph (as one would expect).
I have several other fonts that exhibit the same problem with various other code points.
Attached find: (a) the test case code, (b) the test font, (c) output from test case, and (d) the TCPDF generated metadata file for the font which contains the code points in its 'cw' array.