From the zoomed in plot, it looks as though your enable-disable code for the second transfer is incorrectly blowing through the poll loop. For whatever reason, the SPIF bit must still be set, even after the write to TDBR followed by the ssync...two things that I would verify:
1> Make sure the ssync instruction is not getting optimized away. Try protecting it by changing asm("ssync;"); to volatile asm("ssync;");
2> Verify that the assembly source being generated by the compiler is correct for accessing the MMR space. Specifically, the SPI data registers (TDBR and RDBR) are 16-bit and need to be accessed as 16-bit words, not as bytes. By default, the compiler designates the char data type as byte-wide, and that is how you are defining your data. If, for example, the return (*pSPI_RDBR) is creating a byte access to SPI_RDBR, then this read is not actually taking place and might be messing with the internal status of the SPI such that the NEXT expected transmit gets affected. You can either change your data types to shorts or use type-casting is your code to ensure that the registers are accessed appropriately.
-Joe
