Kerberos Authentication from Multiple Forests

No 401 message, not even one from an AD-bound server, would indicate anything about a specific domain or forest. The F5 in the Forest B environment doesn't care where you get the ticket from as long it can decrypt it based on the keytab. The client and/or KDC in Forest B have to figure that out. Further, the client shouldn't be sending a TGS request to Forest A. It should be sending a krbtgt request to Forest A for access to Forest B's KDC, to then send a TGS request to Forest B.

Is there a global catalog between these forests? Have you determined any DNS failures?