This required a fix to fontTools/cffLib. When reading a CFF2 variable font (VF) from XML, the VF state in FontDict and PrivateDict does not get set. I made a temporary fix by adding a loop to set PrivateDict.vstore for all the PrivateDict objects after the XML file has been read. This should not be necessary, and in the near future I will revisit both this issue, and the related use of isCFF2 when compiling/decompiling.