A 401 and a 404 are quite different errors.  Is the 401 being returned an IIS error or an ASP.NET error?

At this point I think I would be loading up a debugger with the friendly url provider code loaded in, and stopping it at the point it does the Url Rewriting.  Take a look at what the rewritten Url for this particular request is, that may answer your question.

Assuming that is possible, of course.

There is something confusing going on, that's for sure.  Like I said previously, if you've got to the point where module control code is running, then you're well past the point of returning a 401/404 unless there is specific code in that module control which is throwing one of these errors.  A 401/404 code will either occur directly before the Url Rewriting (invalid Url altogether) or directly after (rewritten Url is invalid).  It shouldn't be thrown when you're halfway through the page processing and into the module code.