ADS8353: Writing and Reading the CFR register returns 0x2ff8 instead of what I sent (PIC24)

I am starting to work with the ADS8353 and am not getting what I expect when I try to set the CFR register and read it back.  Based on several forum posts here, I think I am doing it the same way, so clearly I am missing something simple.

My understanding is to write a register, you just put it out as the first 16-bits followed by 32 more clocks.  Using the CCS PIC24 compiler, this looks like this:

    output_low (SlaveSelectPin);
    delay_us (1);
    spi_xfer (SPI2_MODE0, ConfigRegister, 16);
    spi_xfer (SPI2_MODE0, 0, 32);
    output_high (SlaveSelectPin);

Using a Saleae analyzer I can confrm I see the value written out to the wire in the first two 8-bit bytes, followed by 0's for the next 4 bytes (total of 48 bits).

When I try to read a register, I follow the same examples I found elsewhere in this forum:

1) Frame (F) - one empty frame of at least 48 CLKs

2) Frame (F+1) -To readback the user-programmable register settings, the appropriate control word should be transmitted to the device during frame (F+1)

3) Frame (F+2) - During frame (F+2), SDO_A outputs the contents of the selected user-programmable register on the first 16 SCLK falling edges.

In the CCS compiler, it looks like this:

    // Frame (F) - one empty frame of at least 48 CLKs
    output_low (SlaveSelectPin);
    delay_us (1);
    spi_xfer (SPI2_MODE0, 0, 16);
    spi_xfer (SPI2_MODE0, 0, 32);
    output_high (SlaveSelectPin);
    delay_us (1);

    // Frame (F+1)
    // To readback the user-programmable register settings, the appropriate
    // control word should be transmitted to the device during frame (F+1)
    output_low (SlaveSelectPin);
    delay_us (1);
    spi_xfer (SPI2_MODE0, Value, 16); // Write 16 bits.
    spi_xfer (SPI2_MODE0, 0, 32);     // Pad to 48 CLKs.
    output_high (SlaveSelectPin);
    delay_us (1);

    // Frame (F+2)
    // During frame (F+2), SDO_A outputs the contents of the selected
    // user-programmable register on the first 16 SCLK falling edges
    output_low (SlaveSelectPin);
    delay_us (1);
    Value = spi_xfer (SPI2_MODE0, 0, 16); // Write 16 bits.
    spi_xfer (SPI2_MODE0, 0, 32);     // Pad to 48 CLKs.
    output_high (SlaveSelectPin);

I write the CFR by sending 0x8640 padded to 48-bits.

To read, I send:

1) 48-bits of 0

2) 0x3000 ...padded to 48-bits of zero

3) 48-bits of 0's reading the response in the first 16.

But I get back 0x2ff8 -- and the start bits of 0010 (0x2) which looks like it is giving me a REFDAC_B register instead of CFR (which should start with 0011 - 0x3).

My analyzer shows things populated in the expected areas to read DAC A (0x00 0x00  DACA DACA xx xx) so it appears I am talking to the part. I expect I am missing something in setting the CFR.

Any clues on what I have missed in the data sheet?

Thanks, much.