I have the same problem. Although the datasheet states that "SPTEF is automatically set when all data from the transmit buffer transfers into the transmit shift register", I do not believe this to be true when CPHA and CPOL are zero.
When CPHA and CPOL are zero, in 8-bit slave mode, I can only send a single byte per chip select (the first byte). Once I have cleared SPTEF once by writing a byte, it is never set by the HW until CS rises, even though the master has shifted out many bytes. Since it never rises, it is impossible to write more data. The slave simply shifts out what it receives from the master. In my experience, it is impossible for a SPI slave to write more than one byte of data in a single SPI transaction (SS falls, transaction data, SS rises). My slave is required to send several bytes per CS, and this does not work (in my case, with a KL16Z32 and a KL25). I have not tried in 16-bit slave mode.
From KSDK 1.2, I modified the spi_loopback project so that it performs a genuine loopback test. To do this, I cut and pasted some slaveUserConfig/spiSlaveState/SPI_DRV_SlaveInit/SPI_DRV_SlaveTransfer stuff from the spi_non_blocking/slave project. I got the loopback test working between SPI0 and SPI1, and data is reliably passed from virtual master to slave and vice-versa on a FRDM-KL25Z board. But I believe this only works because the SPI Slave only sends a single byte per transaction. SS is toggled after each byte.
I also connected my KL16 SPI master to a KL25 SPI slave running the KSDK1.2 spi_polling/slave project. If my master toggles SS between every byte, the SPI slave transfers data to the master reliably. If I keep SS low during the entire block transfer, the slave only transfers the first byte.
So, it appears to me that there is a problem with the Freescale Kinetis hardware. If CPHA is set, then things appear to work better.
Sidenote: I discovered a minor software bug in the Freescale MKL16Z4.h file. The status byte of the SPI_Type structure is declared with _I instead of _IO. According to the reference manual, it is necessary to write to the SPMF bit to clear it.
