broken Openssl TLSv1.3 connection on Debian Trixie (13.1)

### Windows Version

Microsoft Windows [Version 10.0.26200.7019]

### WSL Version

2.6.2.0

### Are you using WSL 1 or WSL 2?

- [x] WSL 2
- [ ] WSL 1

### Kernel Version

6.6.87.2-microsoft-standard-WSL2

### Distro Version

Debian 13.1

### Other Software

OpenSSL 3.5.1 1 Jul 2025
curl 8.14.1

### Repro Steps

1. `curl -v https://repo.packagist.org/packages.json`

### Expected Behavior

```
HTTP/2 200
```

### Actual Behavior

```
* Recv failure: Connection reset by peer
* TLS connect error: error:00000000:lib(0)::reason(0)
* OpenSSL SSL_connect: Connection reset by peer in connection to repo.packagist.org:443
* closing connection #0
curl: (35) Recv failure: Connection reset by peer
```

Also tested in docker. Here results:

- curl -> Windows = [v] no problem
- curl -> Debain 13.1 -> Windows = [x] problem
- curl -> Debian 12.12 (in docker) -> Debain 13.1 -> Windows = [v] no problem
- curl -> Debian 13.1 (in docker) -> Debain 13.1 -> Windows = [x] problem

result of `openssl s_client -connect repo.packagist.org:443`
```
Connecting to 169.150.247.34
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
Negotiated TLS1.3 group:
---
SSL handshake has read 0 bytes and written 1560 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
```

wget works fine.
openssl with argument `-tls1_2` works fine.
curl with argument `--tls-max 1.2` works fine.

### Diagnostic Logs
[WslLogs-2025-11-09_13-46-43.zip](https://github.com/user-attachments/files/23437477/WslLogs-2025-11-09_13-46-43.zip)

Start by reproducing the failure with curl -v https://repo.packagist.org/packages.json and openssl s_client, using the attached WSL diagnostic logs for context. Compare the failing TLS 1.3 behavior with the working TLS 1.2, wget, Windows, and Debian 12.12 cases; done means TLS 1.3 connections from Debian 13.1 under WSL succeed without requiring a TLS version downgrade.

Written by the indexing model from the issue text.