The host finishes the first part of TAR. It should follow another cycle of 4'b1111, when no one drives the bus. But the peripheral immediately starts driving the SYNC.
I believe this bug occurs if the host drives LFRAME# for more than one cycle. The spec allows LFRAME# to be driven for more than one cycle, so this is a bug in the peripheral.