I found this. I suspect that your culprit is DB2 not CICS.
Make sure that if you have a nullable field in your DB2 call that you have a null indicator in the call as well.
I.e. FIELD_1 : WS-NULL-IND-1
If the null indicator value is -1 then the value of FIELD_1 is null.
You need a unique WS null indicator for each nullable field used in the DB2 call.
SQL1074N The address of the password parameter is not valid. Explanation: The application program used an address that is not valid for this parameter. Either the address points to an unallocated buffer or the character string in the buffer does not have a null terminator. The command cannot be processed. User Response: Ensure that a valid address is used in the application program and the input string is null terminated.
Wherever you go, there you are - Buckaroo Banzai