SPI clocking in extra word - STM32F4
the basic deal with half-duplex mode is that it's going to clock until the SPE flag in SPI_CR1 is unset. The HAL_SPI_Receive doesn't unset this until its received a byte. By the time it gets around to unsetting this flag, the next transfer has already started. 

To properly receive the number of bytes you want, using half-duplex mode, follow the procedure in 20.3.8 of the reference manual. The basic outline is:


Wait for the second to last occurrence of RXNE=1 (n-1) (end of data1)
Wait for one SPI clock cycle and then disable SPE (SPE=0) (at beginning of safety byte rx.)
Then wait for the last RXNE=1 and your last byte is waiting for you in the register. (grab the safety byte).


On a more general note, HALs provided by the manufacturers are pretty good for getting you started, but they generally do not cover all the possible cases. It is better to use it as a starting off point or suggestion especially if it doesn't do exactly what you want it to do.