This came out of a longer analysis of @enweiwu in D38508 and related revisions.
The basic problem is that if a scan is running we cannot start a new one, wpa_supplicant then never gets scan results and scan parameters cannot change.
This one will make wpa_supplicant at least query scan results but we still cannot start new scans which is a different problem to solve.