spi: master doesn't transfer 2 MSB in data byte

[olajep]

Test case:
fclk0 = 25 MHz clkdiv=254 sclk = 100 kHz

1. Master writes 0xff to SPI_USER0
2. Master reads data from SPI_USER0

As seen in the waveform capture master does not transfer the two most significant bits in the data byte.
This does not seem to happen in simulation.

waveform.vcd.txt

[olajep]

It also drops the 2 MSB in the command byte.