Insecure MAC built on pseudorandom function
assuming that it is a deterministic MAC using a canonical verification


It is not, randomness is involved in the tag generation, therefore it is not deterministic and cannot use canonical verification.

This then means that an attacker doesn't have to follow the MAC algorithm but instead has to find $m',(r',t')$ such that verification suceeds, picking $t'=0$ is a good starting point for that.