Dual SPI XIP mode doesn't work on HiFive1 RevB

I’m trying to speed up the flash interface and faced with a problem. When I configure the interface to use 0xBB command in regular mode (ffmt=0x00BB1447) everything works fine, but when I try to switch into AX mode all subsequent commands don’t contain an address part.

My setup sequence (everything is executed from RAM):
read 0x20000010, the result is ok
ffmt=0xA0BB1446 – the same as above, but cmd_en=0
read 0x2000_0004, the result is wrong

First read:

Second read:

The second read contains just 20 cycles (4 dummy cycles and 16 data cycles) instead of 32 cycles.

How I should set up SPI peripheral for this mode of operation? Is it a hardware bug?
Are there any example for Quad SPI flash mode configuration?