Hadn't it been for a logic analyzer, I wouldn't have solved it.
This is what happened during single transfer: 0x02 0x03 0x03 0x00 0x07 0xd0 0x91. RTS (second timeline) is asserted just before entering stateTransision() and deasserted just after return from this function.
Notice how, after the address byte, the code in stateTransition executes swiftly. The gap between address byte and the payload, which allows the address byte to be received correctly, is caused by the fact that, in order to emulate 9-bit UART on a laptop virtual COM, I have to change parity from 'Mark' to 'Space'. Then a