I'm not sure if your test is a supported way of the Keil simulator to simulate reception of serial data.

As you have noticed, SBUF is two registers. One read-only and one write-only. The processor will select the correct register depending on the data-direction implied by the op-code. But what isn't clear is if the Keil debugger has an input box where you can write data that simulates UART receive, or if it is a box that can simulate a UART transmit.

But note that the debugger have a virtual variable that can be assigned to simulate that the UART have received data. You can use the debugger script language either send in a continuous number of characters, or have a button introduce a single received character.

In your post, you never mention what broke in your program after your changes. Only that you after the program broke, you have located a specific situation in the simulator where you do not know exactly what happens, and what is expected to happen. If this is related to your changes or to the problem with your program can not be deduced from your text, or from the description of your analysis of the problem.