According to my experience the endpointID comes first (index 0) in the payload (verified with all of my MultiInstance devices)
The second index turns out not to be the controllerID, but the destination endpoint id (I think to support direct association between instances from one multichannel device to another, although I'm not sure because I don't have such associations :-)
This doc is helpful: http://z-wave.sigmadesigns.com/wp-content/uploads/2016/08/SDS12657-12-Z-Wave-Command-Class-Specification-A-M.pdf
-> page 484 in this case.
According to my experience the endpointID comes first (index 0) in the payload (verified with all of my MultiInstance devices) The second index turns out not to be the controllerID, but the destination endpoint id (I think to support direct association between instances from one multichannel device to another, although I'm not sure because I don't have such associations :-) This doc is helpful: http://z-wave.sigmadesigns.com/wp-content/uploads/2016/08/SDS12657-12-Z-Wave-Command-Class-Specification-A-M.pdf -> page 484 in this case.