Rick,
Thanks for your response.
When running with a faster clock (~10 MHz) read data looks like a right-shifted version of what was written. E.g writing 0x00FF returns 0x003F, writing 0x0FFF returns 0x003FF.
SCLK, SCS and SDATAI all look clean. SCLK has no spurious edges. The pullup on SDATO is ~10k and the rising edges of SDATAO are fairly fast. I'll try a lower value pullup.
Andy