Hello,
You are ok for the write steps.
For the read steps, it doesn't work like that.
The RF can't "request" a message by doing a read.
The RF polls the HOST_PUT_MSG bit.
The MCU writes a message into the mailbox. This sets HOST_PUT_MSG=1.
Then, when detecting the HOST_PUT_MSG=1, the RF can send a Read Message command to read the message written by the MCU.
When RF has read the complete message, the RF_GET_MSG bit is set.
There is no register or command that RF can use to ask for a message. This message request has to be done be writing a specific message into mailbox that the MCU can recognize as a request for some specific data.
Hope this clarifies.
Best regards.