You don't empty the SSPBUF after receiving the adress and the first data-byte gives you an buffer-overrun.....