Is it normal to receive the additional bytes (0x010203) from the W5500 before the requested data? In this case the version (0x04).
In another post I noticed someone else receiving similar output from the W5500.
Attached is the scope trace. D7 - clock, D6 - select, D5 - MISO (0x01020304), D4 - MOSI (0x00390000).