AES CBC MAC splicing attack
Just for completeness sake, CBC is defined as follows:


The error you have made is that:

$$M;N = (M_1, ..., M_n, N_1 ⊕ \mathbf{T_m}, N_2, ..., N_n)$$
(I've changed notation from M||N to M;N to reflect this isn't just concatenation)

You need to cancel the tag from the message $M$, not the tag from the $N$ message.
In that case, $T_{M;N}=T_N$ as required.