I’ve never read out 1 from 09 Carrier Detect register, the value is always 0 in any case. It should be a bug within nRF24L01.
My solution is taking a real listen instead of Carrier Detect before send in jam situation. The listen takes 856 uS, 856-258=598, 3~4 times of CD time.