Comment # 17 on bug 1195395 from Dirk Mueller

(In reply to Dirk Mueller from comment #16)
> My current guess is that pmf=2 would make you able to connect again.

it appears that in the protocol handshake, the AP (fritzbox) is declaring to
not require protected management frames. which is sort of true, it doesn't
require it in WPA2 mode. However by specification WPA3 is always with PMF
enabled, and it appears wpa_supplicant would have to ignore the AP advice and
connect in SAE mode with PMF enabled. 

pmf=2 forces PMF even if the AP says it doesn't require it.