If this works, the problem is with security negotiation. You can further investigate via the :
NLA mismatches often yield 0x904 + 0x7.