Read / write to the same file descriptor with shell redirection

I'm trying to understand file descriptors in the context of shell redirection.

Why can't I have cat read from FD 3, which is being written to by ls's STDOUT?

{ err=$(exec 2>&1 >&3; ls -ld /x /bin); exec 0<&3; out=$(cat); } 3>&1;

When try this, cat still wants to read from my keyboard.

If this can't be done, why not?

Differentiation: This question is about reading / writing to the same file descriptor, using the problem presented by Redirect STDERR and STDOUT to different variables without temporary files as an example.