For an exact number of assumed successes, your logic is fine, except for what might be just a typo: the dice that are not successful cannot roll a number greater than 4, so they're effectively d4s, not d6s. For example, assuming exactly \$k\$ successes (i.e. rolls of 5+) out of \$n\$, the distribution of failures is the same as if you rolled \$(n-k)\$d4 and counted failures (i.e. rolls of 1 or 2) among those.
Here's an AnyDice script demonstrating this, using the "empty die trick" described in this answer to calculate the conditional probabilities.
For at least \$k\$ successes, however, you also need to consider the cases with \$k+1\$, \$k+2\$, ..., \$n\$ successes, and take a weighted average of the failure counts in each case (with the weights given by the probabilities of rolling each possible number of successes).
In particular, the probability of getting exactly one fail, assuming that there are at least two successes, on 3d6 is not 33%; it's actually 3/7. There are two ways to calculate this by hand:
The probability of rolling exactly two successes on 3d6 is \$3×(1/3)^2×(2/3)=2/9\$, while the probability of rolling three successes is \$(1/3)^3=1/27\$. The conditional probabilities of getting one failure in those two cases are, of course, \$1/2\$ and \$0\$ respectively. Thus, the probability of getting one failure if there are two or three successes is $$\frac{(1/2)×(2/9)+0×(1/27)}{2/9+1/27} = \frac{1/9}{6/27+1/27} = \frac{3/27}{7/27} = 3/7.$$
Denoting success with S, failure with F and neither with -, there are seven possible outcomes with two or more successes: SSF, SS-, SFS, S-S, FSS, -SS and SSS. Each of those is equally likely (since each die is equally likely to roll a success, a failure or neither), and out of those, exactly three have one failure.
Of course, we can also modify the AnyDice code above to calculate the number of failures on \$k\$ or more successes. The screenshot below shows the output for \$n=4\$: