Figuring out the protocol of an SPI device without a datasheet
I don't think you'll be able to get anywhere by just addressing registers at the input and seeing what comes out. For one, this doesn't answer how you are supposed to initialize the controller, which is vital to using the part. That's also a lot of data to analyze.

You'll probably get a lot farther by sniffing the SPI lines of the touch panel in situ. Mechanically it may be challenging to get probes on those lines while it's connected to the rest of the iPad, but electrically it's worth it.

Probe all four lines and record commands on startup (filter out anything where CSL is high). That'll show you how the uC initializes the controller, as well as the clock frequency. Next you can just look for patterns in the commands during operation and you should be able to figure out what registers it's polling to get touch info. This will be 1000% easier with a scope or logic analyzer that can decode and record SPI, because you can just export the list of commands to an excel doc and work from there.