df (filesystem level) sees what is happening at filesystem level whereas du (userspace level) sees what is happening at file/directory level.
- An inconsistent file system requiring fsck.
- A process has an open file which does not exist in file system because the file has been deleted. The space used by this file is not reported by du but it is reported by df.
- The mount point directory contains data.
- The du command is being run as a non-root user and there are directories which restrict read permissions for that user.
- The file system contains one or more storage checkpoints. Space used by storage checkpoints are not reported by du but it is reported by df.