This appears to be a hardware bug. However there may be a good reason for the behavior, since it is quite explicit in the source Verilog.

The JTAG data registers are all one bit bigger than stated in Section 4.3. When shifting a register in an extra top bit is provided, but ignored. When shifting the register out however the extra bit is provided before the CRC. This affects all data registers. The data register specifying the debug chain has the format in Figure 4.13.

Figure 4.13.  JTAG chain data register actual implementation.

The formats of the data registers used with the RISC_DEBUG and WISHBONE debug chains are the same, as shown in Figure 4.14.

Figure 4.14.  JTAG RISC_DEBUG> and WISHBONE debug chains data register actual implementation.

The format of the data register used with the REGISTER debug chain is shown in Figure 4.15.

Figure 4.15.  JTAG REGISTER> debug chain data register actual implementation.