Running the below on the emulator returns 9, 0b1001, bit 3 is the 'auto_tx' bit, bit 0 the 'select'. Its missing the slow clock bit.
On hardware it returns 7, 0b0111, bit 2 being the 'auto_tx' bit, bit 1 is 'slow clock' and bit 0 the 'select'.
poke $9f3f, $ff
print peek($9f3f)