AT89LP51ED2 SPI ISP -- First attempt to enter ISP mode after reset yields wrong data back, but second attempt works
It looks like you may be getting an extra clock pulse before the last bit of the 4th byte. The slave thinks that all 8 bits have been sent, and it starts driving a 0 on the MISO line on the last bit because it perceives that as being the first bit of the next byte.

Then, all the data is shifted over by one as a result.

I think you can't see this extra clock pulse because your clock rate is so slow that you have to be way zoomed out on the oscope. Try zooming in on that area between the 7th and 8th bit, and adjusting the oscope so that it can see the smaller pulse. 

Whether this caused by hardware or software is hard to say, but I would guess software--look for something that could cause a small clock glitch.