Missing last byte of transmission in SPI slave mode

I'm using an Arduino to act as a SPI slave to another device. I got it working well in slave mode except that every time the master device writes data, I don't get a SPI interrupt for the last byte of the transmission. Every other byte before is received correctly though. I wondered if maybe CE was being de-asserted too soon so I did some captures with a logic analyzer. There doesn't seem to be any problem timing-wise though. CE is de-asserted about 14-15 us after the final rising clock edge:

Regardless, I wired up the Arduino so I could control the CE timing myself and delay the de-assertion. I wired the master's CE to an interrupt pin on the Arduino, then used a GPIO output connected right back to the Arduino's real SPI CE pin. I could assert the HW SPI line low right when it went low, but delay setting it back high for some time after the master did. Sure enough, this works and I get the last byte! Problem is I don't have enough pins to spare to do this trickery in my actual implementation.

Has anyone else experienced this?

Nevermind, found my problem. I had CPOL/CPHA wrong which was causing this issue. I had it set both to 0, for my case (idle high, sample on rising edge), they should both be 1. This fixed my issue.