There seems to be a bug in the HSS / bare-metal-library:
mailbox_reg needs to be declared as “volatile uint32_t * mailbox_reg;”, otherwise the read/modify/write cycle starting at line 2021 will lead to unpredictable values
In our case, this lead to the 17th byte of the MSS_SYS_SPI_COPY_CMD operation being corrupted.
This byte contains the options / clock frequency, which explains why we were seeing wrong frequencies and data corruption.
This is likely also the root cause for why this workaround is necessary:
polarfire-soc/hart-software-services@c058394