It's a bit tricky to use du and ls on the internal flash (although du might possibly work - I don't have a file to check on right now) vs. the size reported by df. This is because the internal flash is a compressing file system.

A problem that seems to have been fixed in the new firmware is that there used to be a file /var/run/wtmp that would appear to grow to an enormous size (IIRC even 'du' reported it as large), but if you reduced the size (by cat /dev/null > /var/run/wtmp - one must not try to remove files that are possibly open by a process, that won't remove the data, but this method will zero the size safely) then the 'df' size wouldn't go down by more than a few kilobytes. It's all because of the compressing filesystem.

This makes it difficult to figure out things by adding up individual file sizes and comparing to what 'df' reports.