diff --git a/src/HAP.cpp b/src/HAP.cpp
index 0296c39..ad6fe14 100644
--- a/src/HAP.cpp
+++ b/src/HAP.cpp
@@ -966,8 +966,8 @@ int HAPClient::postPairingsURL(){
       tlv8.val(kTLVType_State,pairState_M2);                // set State=<M2>
       break;
       
-    case 5:                     
-      LOG1("List...\n");
+    case 5:        
+      LOG1("List...\n");   
 
       // NEEDS TO BE IMPLEMENTED - UNSURE IF THIS IS EVER USED BY HOMEKIT
 
@@ -1411,12 +1411,11 @@ void HAPClient::eventNotify(SpanBuf *pObj, int nObj, int ignoreClient){
 
 void HAPClient::tlvRespond(){
 
-  int nBytes=tlv8.pack(NULL);      // return number of bytes needed to pack TLV records into a buffer
-  uint8_t tlvData[nBytes];         // create buffer
-  tlv8.pack(tlvData);              // pack TLV records into buffer
+  TempBuffer <uint8_t> tBuf(tlv8.pack(NULL));         // create buffer to hold TLV data    
+  tlv8.pack(tBuf.get());                              // pack TLV records into buffer
 
   char *body;
-  asprintf(&body,"HTTP/1.1 200 OK\r\nContent-Type: application/pairing+tlv8\r\nContent-Length: %d\r\n\r\n",nBytes);      // create Body with Content Length = size of TLV data
+  asprintf(&body,"HTTP/1.1 200 OK\r\nContent-Type: application/pairing+tlv8\r\nContent-Length: %d\r\n\r\n",tBuf.len());      // create Body with Content Length = size of TLV data
   
   LOG2("\n>>>>>>>>>> ");
   LOG2(client.remoteIP());
@@ -1426,10 +1425,10 @@ void HAPClient::tlvRespond(){
 
   if(!cPair){                       // unverified, unencrypted session
     client.print(body);
-    client.write(tlvData,nBytes);      
+    client.write(tBuf.get(),tBuf.len());      
     LOG2("------------ SENT! --------------\n");
   } else {
-    sendEncrypted(body,tlvData,nBytes);
+    sendEncrypted(body,tBuf.get(),tBuf.len());
   }
 
   free(body);
@@ -1667,6 +1666,44 @@ void HAPClient::removeController(uint8_t *id){
 
 //////////////////////////////////////
 
+int HAPClient::listControllers(uint8_t *tlvBuf){
+
+  int nBytes=0;
+  int n;
+    
+  tlv8.clear();
+  tlv8.val(kTLVType_State,pairState_M2);      
+
+  for(int i=0;i<MAX_CONTROLLERS;i++){           // loop over all controller slots
+    if(controllers[i].allocated){
+      
+      if(tlv8.val(kTLVType_State)==-1){          // if State is not set then this is not the first controller found
+        n=tlv8.separate(tlvBuf);                 // add separator
+        nBytes+=n;
+        if(tlvBuf){
+          tlvBuf+=n;
+          LOG2("SEPARATOR(0)\n");
+        }
+      }
+                                   
+      tlv8.val(kTLVType_Permissions,controllers[i].admin);      
+      memcpy(tlv8.buf(kTLVType_Identifier,36),controllers[i].ID,36);
+      memcpy(tlv8.buf(kTLVType_PublicKey,32),controllers[i].LTPK,32);
+      n=tlv8.pack(tlvBuf);
+      nBytes+=n;
+      if(tlvBuf){
+        tlvBuf+=n;
+        tlv8.print();
+      }
+      tlv8.clear();
+    }
+  }
+
+  return(nBytes);       
+}
+
+//////////////////////////////////////
+
 void HAPClient::printControllers(int minLogLevel){
 
   if(homeSpan.logLevel<minLogLevel)
diff --git a/src/HAP.h b/src/HAP.h
index 7b04973..d46ea63 100644
--- a/src/HAP.h
+++ b/src/HAP.h
@@ -141,6 +141,7 @@ struct HAPClient {
   static void removeControllers();                                                     // removes all Controllers (sets allocated flags to false for all slots)
   static void removeController(uint8_t *id);                                           // removes specific Controller.  If no remaining admin Controllers, remove all others (if any) as per HAP requirements.
   static void printControllers(int minLogLevel=0);                                     // prints IDs of all allocated (paired) Controller, subject to specified minimum log level
+  static int listControllers(uint8_t *tlvBuf);                                         // creates and prints a multi-TLV list of Controllers (HAP Section 5.12)
   static void checkNotifications();                                                    // checks for Event Notifications and reports to controllers as needed (HAP Section 6.8)
   static void checkTimedWrites();                                                      // checks for expired Timed Write PIDs, and clears any found (HAP Section 6.7.2.4)
   static void eventNotify(SpanBuf *pObj, int nObj, int ignoreClient=-1);               // transmits EVENT Notifications for nObj SpanBuf objects, pObj, with optional flag to ignore a specific client
diff --git a/src/HomeSpan.cpp b/src/HomeSpan.cpp
index 70ab0d2..082c547 100644
--- a/src/HomeSpan.cpp
+++ b/src/HomeSpan.cpp
@@ -554,6 +554,15 @@ void Span::processSerialCommand(const char *c){
 
   switch(c[0]){
 
+    case 'Z': {
+      Serial.printf("\n\n");
+      TempBuffer <uint8_t> tBuf(HAPClient::listControllers(NULL));
+      Serial.printf("Buffer Size: %d\n",tBuf.len());
+      HAPClient::listControllers(tBuf.get());
+      HAPClient::hexPrintRow(tBuf.get(),tBuf.len(),0);
+      break;
+    }
+
     case 's': {    
       
       LOG0("\n*** HomeSpan Status ***\n\n");
diff --git a/src/TLV.h b/src/TLV.h
index 505c4f8..f6d7e0a 100644
--- a/src/TLV.h
+++ b/src/TLV.h
@@ -30,7 +30,7 @@
 template <class tagType, int maxTags>
 class TLV {
 
-  int cLen;              // total number of bytes in all defined TLV records, including TAG andf LEN (suitable for use as Content-Length in HTTP Body)
+  int cLen;              // total number of bytes in all defined TLV records, including TAG and LEN (suitable for use as Content-Length in HTTP Body)
   int numTags;           // actual number of tags defined
   
   struct tlv_t {
@@ -59,7 +59,7 @@ public:
   void print(int minLogLevel=0);            // prints all defined TLVs (those with length>0), subject to specified minimum log level
   int unpack(uint8_t *tlvBuf, int nBytes);  // unpacks nBytes of TLV content from single byte buffer into individual TLV records (return 1 on success, 0 if fail) 
   int pack(uint8_t *tlvBuf);                // if tlvBuf!=NULL, packs all defined TLV records (LEN>0) into a single byte buffer, spitting large TLVs into separate 255-byte chunks.  Returns number of bytes (that would be) stored in buffer
-  int pack_old(uint8_t *buf);               // packs all defined TLV records (LEN>0) into a single byte buffer, spitting large TLVs into separate 255-byte records.  Returns number of bytes stored in buffer
+  int separate(uint8_t *tlvBuf);            // if tlvBuf!=NULL, packs a TLV separator into a single byte buffer.  Returns number of bytes (that would be) stored in buffer
   
 }; // TLV
 
@@ -211,6 +211,20 @@ void TLV<tagType, maxTags>::print(int minLogLevel){
   } // loop over all TLVs
 }
 
+//////////////////////////////////////
+// TLV separate(tlvBuf)
+
+template<class tagType, int maxTags>
+int TLV<tagType, maxTags>::separate(uint8_t *tlvBuf){
+  
+  if(tlvBuf){              // load separator
+    *tlvBuf++=kTLVType_Separator;
+    *tlvBuf=0;
+  }
+
+  return(2);
+}     
+
 //////////////////////////////////////
 // TLV pack(tlvBuf)