Hello Ben,
The KW41z Host Controlled Device is managed by the SerialManager module which includes THCI support for UART, USB and SPI.
You can select the interface in the file: middleware\wireless\nwk_ip_1.2.0\examples\host_controlled_device\config\config.h
#define THCI_UART_ENABLE 0
#define THCI_SPI_ENABLE 1
That will set the SPI interface (slave) for the Host Controlled Device project.
The slave will trigger the master for a TX(see gSerialMgrSlaveDapTxLogicOne_c and mSpiSlaveDapCfg in SerialManager.c).
Every serial (THCI) packet has a header. When the slave indicates there's pending data, the master should transfer over the SPI the packet header, check in the header the packet length, and then transfer the remaining bytes.
-JC