How to ensure that an SPI master sends exactly 16 clock pulses to the slave?
You are using HAL_SPI_Receive() wrong, second parameter should be your buffer not SPI register. Other potential problem is that you have short timeout (fourth parameter) with slow SPI clock.

You can also make living easier if you look at your hspi1 configuration and change data size to 16 bits.

EDIT

If second parameter is your buffer and not SPI register, that I would still increase timeout and check if HAL_SPI_Receive() return success or error.