...And I've now discovered that I misunderstood what the SD Association specs were trying to say in my previous post. CMD10's response is handled as a data transfer, like CMD17, so there is a CRC16 at the end.
The latest committed version of spi_sdcard should have an MMFS-compliant CMD10 response.