Authenticated Encryption of UDP packets
You can use DTLS here.  C# can call any C API via P/Invoke.  OpenSSL, BoringSSL, Network Security Services (NSS), and mbedtls all provide C interfaces to DTLS.

Unless there are existing bindings, you will need to implement at least some of the P/Invokes yourself, but this is much easier than writing your own cryptographic protocol.

It would be very nice if you could open-source these bindings, for the benefit of those who follow in your footsteps.

Also, note that AES-GCM is, in the absence of hardware support, very tricky to implement in a way that is immune to cache-timing side-channel attacks &mdash; so tricky, in fact, that many production implementations are not hardened against such attacks.  Implementations that are immune to cache-timing attacks deliver suboptimal performance.  ChaCha20-Poly1305 is an efficient, secure, and portable alternative.  It is several times faster than pure-software AES-GCM while being immune to many side-channel attacks.  Since you mention mobile devices, you probably will not have hardware support for AES, so ChaCha20 is both faster and easier to implement securely.