TX = 55 03 3F FF 00 01 = read holding register at 16384 [0x4000]
RX = 55 FF 01 .....
I am expecting 03 or 83 in the second word.
Has anyone ever seen FF in what should be the function field?

 

If I set my simulator to slave, I'm getting the same signal from the device - 55 FF 01 ...
But this FF in the function code field is still not a valid Modbus format.

 

55 FF is the preamble for BACnet MS/TP packets. It seems the device you have is communicating using the BACnet MS/TP protocol, not Modbus.

Perhaps the device supports both protocols and you simply need to change a configuration setting on the device for it to use Modbus instead of BACnet.