It's in managmenet frames that you can sniff.

Does wpa3 pmf fix this particular issue?

This isn't considered "broken" — it's part of how WiFi works/associates.