What is the difference between `fallocate --dig-holes` and `fallocate --punch-hole` in Linux?

In short:

• --dig-holes makes a file sparse without modifying its contents (as seen by a program reading it).
• --punch-hole creates a hole in a file, possibly modifying existing data.

The difference is that --dig-holes analyzes the file for areas that can be made sparse (using --offset and --length, if supplied, to indicate the range in the file to analyze), whereas --punch-holes uses --offset and --length to actually zero out a part of a file to create a hole.

Note also the plural "dig holes" vs. the singular "punch hole".

From the manual, regarding --dig-holes:

You can think of this option as doing a cp --sparse and then renaming the destination file to the original, without the need for extra disk space.

--dig-holes doesn’t change the file’s contents, as determined when the file is read: it just identifies runs of zeroes which can be replaced with holes.

--punch-hole uses the --offset and --length arguments to punch a hole in a file, regardless of what the file contains at that offset: it works even if the file contains non-zeroes there, but the file’s contents change as a result. Considering your example file, running fallocate --punch-hole --offset 2 --length 10 would replace ten a characters with zeroes, starting after the second one.