System.Text.Json.JsonException thrown when deserializing asynchronously to nullable types

Start with DeserializeDto.cs and NonNullableDeserializeDto.cs in the linked reproduction, then compare JsonSerializer.DeserializeAsync<List>(stream) with the synchronous Deserialize call. Trace the asynchronous deserialization entry point in System.Text.Json and reproduce the failure with a large data set containing nullable parent objects. Done means asynchronous deserialization succeeds for the nullable model without regressing synchronous behavior.

Description

System.Text.Json.JsonSerializer.DeserializeAsync fails with exception
System.Text.Json.JsonException: 'The JSON value could not be converted to STJDeserializationException.DeserializeDto. Path: $[57] | LineNumber: 0 | BytePositionInLine: 19343.'

Deserializing the same data into the same object works when using the synchronous deserialization method, JsonSerializer.Deserialize.

Asynchronous deserialization, JsonSerializer.DeserializeAsync, works if the object T does not contain nullable parent types.

Reproduction Steps

I created a GitHub repo with the minimum classes to fully reproduce the behavior I am seeing - https://github.com/emonino/STJDeserializationException.

When we try to deserialize data into a simple object with a nullable parent type, DeserializeDto, deserialization fails with a System.Text.Json.JsonException. For example:
System.Text.Json.JsonException: 'The JSON value could not be converted to STJDeserializationException.DeserializeDto. Path: $[57] | LineNumber: 0 | BytePositionInLine: 19343.'

The exact method that throws is await JsonSerializer.DeserializeAsync<List<DeserializeDto>>(stream, options).

However, if we deserialize the exact same data into the same object using the synchronous deserialization method, deserialization works as expected. For example, the below method works:
JsonSerializer.Deserialize<List<DeserializeDto>>(dataStr)

I can also successfully use System.Text.Json if I modify the object I am trying to deserialize into to not include a nullable parent object as seen in NonNullable.DeserializeDto. Note that the only difference between DeserializeDto and NonNullable.DeserializeDto is that the Start parent object is nullable in DeserializeDto.

In other words, this code also works as expected:
await JsonSerializer.DeserializeAsync<List<STJDeserializationException.NonNullable.DeserializeDto>>(stream, options)

Expected behavior

Asynchronous deserialization to nullable objects should succeed

Actual behavior

Asynchronous deserialization fails with exception similar to
System.Text.Json.JsonException: 'The JSON value could not be converted to STJDeserializationException.DeserializeDto. Path: $[57] | LineNumber: 0 | BytePositionInLine: 19343.'

Regression?

We first noticed this error after upgrading from System.Text.Json 7.0.4 to 8.0.2. We have since upgraded to System.Text.Json 9.0.0. The exception is thrown less often now, but can still occur for large data sets.

Known Workarounds

Using JsonSerializer.Deserialize or making parent objects non-nullable.

Configuration

No response

Other information

No response