df says the disk is 100% full, but du only finds 40% used. Where did the space go?

A process still has the deleted file open. The space isn't freed until the last file handle closes.

• Find it: lsof +L1 (or lsof | grep deleted).
• Free it: restart or reload the process, or truncate through /proc/<pid>/fd/<n> if you can't restart.
• Other causes: inodes exhausted (df -i), files hidden under a mount point, or reserved blocks for root.
• Prevent it: logrotate with copytruncate or a reload signal, and alerts on disk usage trends rather than only at 95%.