The pa_tnc fuzzer does not rely on any plugins and the pb_tnc fuzzer is a bit special in that it does use code from the tnccs-20 plugin, but that doesn't actually have to be loaded as such. The fuzzer directly calls statically linked code from the plugin.