odbc_stmt_param_hook() emallocs P->outbuf for output and INPUT_OUTPUT parameters at PDO_PARAM_EVT_ALLOC, hands it to the driver with SQLBindParameter, and never frees it. The buffer outlives the bound-parameter struct (PDO destroys that mid-statement on execute($array) or when a position is rebound), so it cannot be freed at parameter-free time without leaving the ODBC statement pointing at freed memory. Track the allocated buffers on the statement and free them in the destructor, after SQLFreeHandle has dropped the bindings.

Reproducer, leaks under a debug or ASAN build:

$pdo = new PDO('odbc:Driver=SQLite3;Database=:memory:');
$stmt = $pdo->prepare('SELECT ? AS v');
$var = 'seed';
$stmt->bindParam(1, $var, PDO::PARAM_STR | PDO::PARAM_INPUT_OUTPUT, 256);
$stmt->execute();