What are the common pitfalls when reading Modbus registers?

Two big ones. First, register numbering is famously off-by-one: documentation and conventions often use 1-based references (the "4xxxx" notation, e.g., "holding register 40001"), but the actual address on the wire is 0-based, so 40001 maps to protocol address 0. Reading "register 100" from the docs when the wire wants 99 (or vice versa) silently returns the wrong data, and this trips up nearly everyone integrating a new device. Second, word order for multi-register values: a 32-bit integer or float spans two 16-bit registers, and while bytes within a single register are big-endian (high byte first), the Modbus spec does not standardize the order of the two registers relative to each other, so vendors split 32-bit values in different word orders, you frequently must byte- and/or word-swap according to the specific device's documentation to reassemble a correct float or long. Beyond those: validating the CRC-16 on RTU frames, respecting the inter-frame silent gap (≥3.5 character times) and RS-485 driver turnaround timing, and remembering address 0 is broadcast. So the data-format gotchas (numbering, word order) cause the subtlest bugs, and the timing/CRC gotchas cause the comms-level ones.