I think this is how you wanted your regex to be:
flag:(\S+)="((?:.(?!"(?:\S+)=|">))*.?)"
Note that you do not need to escape that much. & and ; are no special characters and as such don’t need to be escaped. Also HTML entities always end with a semicolon or they are invalid, as such all your question marks after the ; are unneeded (or rather harmful).
Then the actual problem with you expression was the following: The inner group with the negative look-ahead for " expected 1 or more matches (because of the +). In case of the T as the single text, that T was already occupied by the . afterwards (which is correctly required to match the last character for which the negative look-ahead does apply). Now there was no character left to actually match the look-ahead expression (which required one match though). So what did the regexp do instead? It took the semicolon that was marked as optional (because of the ?) and pulled it inside of the capturing group. So that explains where the semicolon comes from.
If you remove the question marks after the semicolons as advised above, then you run in the problem that the regexp does not match the T at all (because it is expecting two or more characters). So the solution is to allow no character to match the negative look-ahead expression (i.e. a * instead of the +). And then, if you want to make the regexp even better, allow empty sequences inside the quotes by adding a ? to the final . too. And then you should have a working expression.
But of course, given that this is encoded using HTML entities, it might be a better idea to simply decode those first, and match directly on the quotes then, as Matteo suggested. This answer is merely to explain what was wrong with your expression :)