Luci-rpc "getHostHints" source of hostnames

I have clear that the information for this method comes from several sources, as indicated here

From my tests, I could verify that IPv4 addresses are determinated from the dhcp leases information and ARP table, while IPv6 from IPv6 neighrbors table and dhcpv6 leases.

Regarding the hostnames (which is the parameter "name"), they are obtained by dhcp leases information but also from at least another source which I am not sure which is it, because I was working over a dumb AP device, which is not a dhcp server, and sometimes the parameter "name" is filled for some devices with its hostname.

So, I want to know which are the possible sources to fill this field. Finding them could lead to an alternative to find all the hostnames of the devices in the network without depend on being the dhcp server (like an arp-scan works to find all the ipv4 addresses on the network)

Any suggestions on this would be welcome