The problem I'm having is that the value returned is the address (0xCF), not the value that the address 0xCF stores (0xFF).
PrintHex should write 0xFF to the lcd, instead of 0xCF. (PrintHex is tested and works well).
Anyway, I tried:
if(aux==0xFF) print("OK");
But never prints "OK" (because aux always contains the address, 0xCF, never the value).

There is one thing that the W81E381AD technical manual says that I don't understand:

RXSTAT Address: S:E2H
Does that S mean Stack? Do I have to add Stack start address to E2 so that get RXSTAT address?

I've tried that and it works, I mean, the value I write is the value I can read later but that could be because I am writing to some address position... according to the 8052 tutorial sfr are from 80h to FFh, so I think that doesn't have much sense.

Xavi

PS: Technical manual: http://www.winbond.com/PDF/sheet/W81E381.pdf