Why do keep getting 0x1C as the first byte upon reading off the status register of nRF24L01?

Question

So I seem to be having trouble interfacing with nrfl2401.

To initially test the chip, I sent `0xFF` to be able to read off the status register but when I do, I get `0x1C` in return. And when I tried sending `0xFF` multiple times, I got `0x1C` at the first attempt but `0xE` in subsequent transactions (which is expected).
The following is a capture where I send two bytes (0xFF) and get two bytes in return: the first one being `0x1C` and the subsequent one `0xE` which is the expected one. Also, channel 5 is CSN; was getting mismatching errors so removed the config name.

The SPI mode is configured to be CPHA=0 and CPOL=0. Am I even talking to the device? Also, when I tried to send `(0x20 | 0x1F & 0x8)` to a configuration register, I got `0x1D` in return, which means `MAX_RT` is set. (which I don't think should be the case). 
 
 I am kind of in need of help and figure out what am I missing. Any help is really appreciated. There could be a trick behind 0xE << 1 = 0x1C which i'm not fully able to get. How's how I am configuring SPI: 
 
 SPI_InitTypeDef spi_config = {
 Mode: SPI_MODE_MASTER,
 Direction: SPI_DIRECTION_2LINES, // full duplex
 DataSize: SPI_DATASIZE_8BIT,
 CLKPolarity: SPI_POLARITY_LOW,
 CLKPhase: SPI_PHASE_1EDGE,
 NSS: SPI_NSS_SOFT,
 BaudRatePrescaler: SPI_BAUDRATEPRESCALER_8, // 42MHz/8 <= 10MHz (radio module=10MHz)
 FirstBit: SPI_FIRSTBIT_MSB,
 TIMode: SPI_TIMODE_DISABLE,
 CRCCalculation: SPI_CRCCALCULATION_DISABLE,
 CRCPolynomial: 7
 };
 SPI_Init(&spi_config, SPI2); And here's my init function that's supposed to configure registers: 
void nRF24_SendCommand(nrfl2401 *nrf, uint8_t *txBuffer, uint8_t *rxBuffer, uint8_t size)
{
	RESET_CSN();
	HAL_StatusTypeDef transactionStatus = HAL_SPI_TransmitReceive(nrf->config.spiHandle, txBuffer, rxBuffer, size, 1000);
	SET_CSN();
}

void nRF24_ReadStatusRegister(nrfl2401 *nrf)
{
	uint8_t txBuffer[1] = {nRF24_CMD_NOP};
	uint8_t rxBuffer[1] = {0};
	nRF24_SendCommand(nrf, txBuffer, rxBuffer, (uint8_t) 1);
}

void nRF24_Initialization(nrfl2401 *nrf)
{
	nRF24_ReadStatusRegister(nrf);
 // ...
}