Blown ADC?

This is again a timing issue.

From the graph it's quite clear you are getting those spikes whenever the msb changes.

For example when data crosses the half scale value 512, namely digital value changes from 01111111b to 10000000b, you read 11111111b, as if you get it when only the first bit has changed. Similarly, on the falling slope, you read 00000000b when it makes the opposite transition.

If your ADC is kind of a SAR, this happens because you are failing to wait the required conversion time before reading the result.