W5500 SPI troubles

I’ve got an Arduino Ethernet Shield 2 that I am trying to use as an Ethernet bridge between a computer and an FPGA. To start with, I have been trying to write and read registers in the W5500 on the Shield by connecting the FPGA to its SPI pins.

The strange thing that is happening is that the W5500 always sends me the exact same sequence of data bits when I pull CS low. It does not matter whether I attempt a read or a write transaction; it does not matter which register address I send; I always get the same thing back.

Here’s an example in which I try to read Register 0x12 (fixed data mode, length=1 byte):

That’s an internal logic analyzer capture from inside the FPGA. I have also viewed the signal with an oscilloscope and determined that what the FPGA thinks it’s seeing actually is what is going across the wires. I even get this same result when reading the version register (0x39). Any thoughts?