LTC2984 reads 0xFF F0 64 00 which is -999C with all faults and valid bit set - why?

Using the LTC2984 Demo Circuit 2399A with the 2211A daughter board. Connected are a 44007 thermistor between J2 pins 2 and 3, J2 pins 1 and 2 shorted, J2 pins 3 and 5 shorted. Configured to use the 2K resistor connected to CH1 and CH2 on the 2211A as my sense resistor by writing 0xE81F4000 to address 0x204. Configured CH4 for the thermistor by writing 0xA8860000 to address 0x20C which should indicate a type 44007 thermistor, sense channel 2, differential no share no rotate and auto range excitation current.

I write 0x84 to address 0 to start the conversion. I then read 0x44 from address 0, indicating that the conversion is DONE. I read starting at address 0x1C : 0xFF, F0, 64, 00. Which does not make any sense. All fault bits are set in addition to the VALID bit. The temperature value is -999C. If I read the 4 bytes starting from address 0x1C before trying a conversion, I see all 00s so my readings are not stale data.

Have tried several other combinations with thermistors but always get 0xFFF06400 for the results.

The LTC2984 Demo board is connected to an Atmel Xmega MCU, communicating over the SPI at 2 MHz and providing 3.3V. SPI communication is reliable.

What condition would cause the LTC2984 to set the VALID and ERROR bits at the same time. Must be clue to something.

Any ideas on what I'm missing?