Although now that I look at the reference manual, the F405/415 series has an SPI peripheral which has no FIFO; it has just a single byte buffer. So if you don't read it out, OVERRUN happens. The refman explains the behavior exceptionally clearly:
"In this case, the receive buffer contents are not updated with the newly received data from
the transmitter device. A read operation to the SPI_DR register returns the previous
correctly received data. All other subsequently transmitted half-words are lost."
If I would be implementing such simple SPI peripheral, I would always update the register with the latest received data in case of overrun so you could ignore things by not reading out, but ST though overrun is clearly an error, not intended operation. Don't let it overrun, read out before write. With SPI, this is trivial because you are the master, spurious RX simply cannot happen. In a nutshell, wait for TXE, write, wait for RXNE, read, rinse and repeat.