TLS 1.3 Test throws AuthenticationException from sslStream.AuthenticateAsServer

Question

I am running some TLS tests on a Windows 2022 Server. Tests are.

1. c# SslStream Client to c# SslStream Server using TLS 1.2 - Works fine

2. c Schannel client to c# SslStream Server using TLS1.2. Note that the Schannel code is using the latest SCH_CREDENTIALS / TLS_PARAMS structures - Works fine

3. c# SslStream client to c# SslStream Server using TLS 1.3 - Works fine and I've confirmed that TLS1.3 was the negotiated protocol. i.e.

Console.WriteLine("Protocol: {0}", stream.SslProtocol);

Protocol: Tls13

4. c Schannel Client to c# SslStream Server using TLS1.3. yes this is the problem, but after a succesful handshake the SslStream Server throws an AuthenticationException from the following code. Same code works fine with TLS1.2

sslStream.AuthenticateAsServer(serverCertificate, clientCertificateRequired: false, SslProtocols.Tls13,checkCertificateRevocation: true);

System.Security.Authentication.AuthenticationException: 'A call to SSPI failed, see inner exception.' Inner Exception Win32Exception: The specified data could not be decrypted

Stack trace at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception) at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest, Boolean renegotiation) at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest, Boolean renegotiation) at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest, Boolean renegotiation) at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult) at System.Net.Security.SslStream.AuthenticateAsServer(X509Certificate serverCertificate, Boolean clientCertificateRequired, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation) at Examples.System.Net.SslTcpServer.ProcessClient(TcpClient client) in C:\JohnT\ConsoleApp12\ConsoleApp12\Program.cs:line 42

I'm between a rock and a hard place now. I've confirmed that the Sslstream c# client uses TLS1.3 but what is causing the Sslstream Server to crash when a Schannel client tries to connect ?