AD7793 0xFFFFFF readings on a 0V input

I am debugging a temperature controller using a AD7793 in a configuration similar to figure 21 in

What could cause the AD7793 to give a 0xFFFFFF (ERR bit set) reading on channel 3 when the excitation currents are disabled (and a 0V input is verified with oscilloscope)?