STM32F103 SPI only receives 0x00
As SPI is a synchronous interface, data is received from the slave at the same time as data is transmitted by the master.

In your receive function data is received from the slave while sending the address byte. The slave does not know what register you want to access when it shifts out the first byte as the transmit of the address byte is still undergoing.

Try to add a dummy write (e.g. 0x00) after sending the address byte to enable the slave to shift out the requested data:

uint8_t MRF24J40_ReadShortAddrReg(uint8_t addr)         {
    uint8_t data;
    addr &lt;&lt;= 1;                            //MSB = 0 for short, LSB = 0 for reading
    GPIOB-&gt;BRR = GPIO_Pin_12;              //Enable SPI slave
    SPI_ByteTransfer(addr);                //Send address byte and discard received data
    data = SPI_ByteTransfer(0x00);         //Send dummy byte and receive requested data
    while(SPI2-&gt;SR &amp; SPI_I2S_FLAG_BSY);    //Wait for bus free
    GPIOB-&gt;BSRR = GPIO_Pin_12;             //Disable SPI slave
    return data;  
}