First Bug:
In bcm2835_aux_spi_transfernb it's possible for the RX FIFO to overflow, for example if the process is interrupted between filling the TX FIFO and reading the RX FIFO.
The RX FIFO might still have data in it (and thus have less than 4 slots available), but the TX FIFO just got loaded with 4 words. This then causes the RX FIFO to overflow before the process gets control back from the scheduler.
Second Bug:
if the TX FIFO gets starved, BCM2835_AUX_SPI_STAT_BUSY can become false while tx_len is > 0. In that case the program reads garbage data from RX FIFO before refilling TX FIFO.
Patch for both bugs is attached.