EAP-FAST requires disable_tlsv1_2 = yes, because the PRF label used in FAST is forbidden by the RFCs. And, the PRF function in TLS 1.2 is different from the PRF function in earlier versions of TLS.
disable_tlsv1_2 = yes
The solution is to re-implement the TLS 1.2 PRF function in FreeRADIUS, and then make EAP-FAST use it. For example code, see tls_connection_prf() in the hostap repo.