How does iOS and OS X detect when a Wi-Fi network is a personal hotspot?

When there is a Personal Hotspot network available, it displays a chain link icon instead of the usual lock icon in the list of available networks on iOS and OS X.

My question is, how does OS X distinguish these networks? Is it specified in 802.11 how hotspots broadcast their SSID's differently?

I think this question should be posted in Reverse Engineering Stack Exchange site. You're asking for the implementation details about a black box...

In fact I did dig around a little on /System/Library/CoreServices/Menu Extras/AirPort.menu and /System/Library/Frameworks/CoreWLAN.framework/

There is a private method of CWNetwork called isPersonalHotspot, kind of:

char -[CWNetwork(Private) isPersonalHotspot](void * self, void * _cmd) {
    eax = [*(self + 0x4) objectForKey:@"IOS_IE"];
    eax = LOBYTE(eax != 0x0 ? 0x1 : 0x0) & 0xff;
    return eax;
}

It seems just checking some identifiers. I think SFRemoteHotspotDevice and WiFiXPCEventProtocol may have more low level details but I didn't check.

BTW, There is also a property to identify whether is CarPlay network

@interface CWNetwork : NSObject <NSCopying, NSSecureCoding>
... //redacted
@property(readonly) BOOL isPersonalHotspot;
@property(readonly) BOOL isCarPlayNetwork;
... //redacted

Apple controls the Hardware, the Drivers and the Operating System, I guess they can easily add extra metadata when broadcasting the WiFi signal so your Mac knows to whether adding the chain icon or not.

If anyone figure out exactly how Apple did the trick, please let me know. :)