HAL_I2C_Master_Receive_IT() is generating a write message (STM32H7, 10bit addr)

[fal.sch]

Hello,

I want to receive a message from slave-device with my STM32H7 based master-board. Transmitting works fine but the receive (IT as well as blocking) is generating a write message (as it should be when transmitting).

I verified this with my Rigol oscilloscope as well as with the HAL_I2C_AddrCallback() on the slave.

Master code:

HAL_I2C_Master_Receive_IT(&hi2c4, 0x25B, tx_buf, 12);

I2C configuration (master):

hi2c4.Instance = I2C4;
  hi2c4.Init.Timing = 0x00401242;
  hi2c4.Init.OwnAddress1 = 0;
  hi2c4.Init.AddressingMode = I2C_ADDRESSINGMODE_10BIT;
  hi2c4.Init.DualAddressMode = I2C_DUALADDRESS_DISABLE;
  hi2c4.Init.OwnAddress2 = 0;
  hi2c4.Init.OwnAddress2Masks = I2C_OA2_NOMASK;
  hi2c4.Init.GeneralCallMode = I2C_GENERALCALL_DISABLE;
  hi2c4.Init.NoStretchMode = I2C_NOSTRETCH_DISABLE;

 FW: STM32Cube FW_H7 V1.8.0

[fal.sch]

I have debugged the driver up to the point where MODIFY_REG() sets the CR2 register. The masks for reset, set and the resulting CR2 are the following:

RESET
0000 0011 1111 1111 0110 0111 1111 1111
SET
1000 0010 0000 1100 0010 0110 0101 1011
CR2
0000 0010 0000 1100 0010 1110 0101 1011

This all looks compliant to RM0433 but unfortunately my oscilloscope shows the following:

[fal.sch]

Can someone confirm that the register is set correctly?