When I simulated the sensor on a PC using WinModbus, I found that I could get 0xFFFFFF. That turned out to be because the software serial port had not received a reply back. Just for the purposes of getting a correct response, I put a delay into the code between sending out the command and trying to read the response.
See post #24 in this discussion.