As the question title says: Does Kerberos support vendor specific attributes allowing access segmentation within a given client device?
Microsoft has no SDK/API to change the kerberos protocol, and it wouldn't be a small feat to reimplement kerberos on both sides (client and server) as an authentication package.
I think you are missing a key point with your use case, kerberos is an authentication protocol, as such it should only deal with checking that you are who you say you are, network location isn't part of that. what you require is authorization, this is abstracted away from kerberos as a security measure and it is a bad idea to change that.
what you can do is change the authorization part - on the Domain Controller you can decide which user is allowed to login to which computer (or a OU of devices) using group policy. if this is for your specific application you can always implement it at that level.
another way is to create a site per subnet and allow logon to each user per site. look here.