When you use FIFO mode with sync word check, only the data following the detected sync word will be clocked into the RX FIFO. Since you get 0xAA AA AA AB 01 .. (or 0xAA AA AA AC 04, which is the same as the other shifted 4 places) a 0xAB01 sync word must have been found somewhere else in the received data. What you can try is to is set a very strict sync word match - i.e. set SYNC_CFG1[4:0] to a low value and SYNC_CFG1[4:0] = 0 (0 bit errors in last received sync byte).
On the SPI the MSB is sent first.