How to properly call IDispatch::Invoke with a requ

There are many examples of how to call IDispatch::Invoke with a BSTR* parameter. I have this working with many other "SomeType*" parameter but no matter what I try, I either get HRESULT of Type Mismatch, E_OUTOFMEMORY or an access violation. It seems to me I am doing something wrong with memory but I am following the different examples I have found... As a side note, the final "[out] UINT puArgErr" argument is never filled with the argument index that is causing the problem. However, I know it is the 3rd argument of type BSTR (I have successfully called another method that takes the 2 previous arguments.)

VARIANTARG* v = new VARIANTARG[3];
//...Init my first 2 args
//Code omitted for initializing args 1 and 2 and wrapping everything up to call IDispatch->Invoke

//... Variation 1
VariantInit(v[2]);
BSTR val = SysAllocString(L"");
v[2].vt = VT_BSTR | BT_BYREF;
v[2].pbstrVal = &val;
//When I wrap everything up in the call to IDispatch::Invoke 
//this yields a HRESULT of Type Mismatch

//...Variation 2
VariantInit(v[2]);
BSTR val = SysAllocString(L"");
v[2].vt = VT_BSTR | BT_BYREF;
v[2].bstrVal = val;
//When I wrap everything up in the call to IDispatch::Invoke 
//this yields a HRESULT of E_OUTOFMEMORY

//...Variation 3
VariantInit(v[2]);
BSTR val = SysAllocString(L"RandomStringLargerThanTheMethodWillPlaceInTheOutParam");
v[2].vt = VT_BSTR | BT_BYREF;
v[2].bstrVal = val;
//When I wrap everything up in the call to IDispatch::Invoke 
//this yields an access violation

//...Variation 4
VariantInit(v[2]);
BSTR val = 0;
v[2].vt = VT_BSTR | BT_BYREF;
v[2].bstrVal = val;
//When I wrap everything up in the call to IDispatch::Invoke 
//this yields and HRESULT of 0x800706f4 A null reference pointer 
//was passed to the stub.

I don't understand why when I am following other examples of BTR* parameters this is happening... Furthermore I have many other successful calls to IDispatch::Invoke but this BTR* has me ground to a halt.

DESPERATE, PLEASE HELP!

Addition:

IDL is: [id(0x00000171)] short GetCategory( short nIndx, short* nCat, BSTR* bszName);

You were all on the right track. @HansPassant comment pointed me to the "forehead-slap" "eureka" moment with his surmising about it blowing up on a different parameter. The 1st and 2nd parameters are of a different type. Passed in reverse for ::Invoke they are actually the 2nd and 3rd parameters. So it was actually blowing up on my "1st" parameter with a type mismatch.

In my initial proof-of-concept version I was manually passing parameters and I was purposefully passing the parameters correctly in reverse order as required by IDispatch::Invoke. In the process of converting this to a more generic approach looping through an array of parameters passed from the caller I reversed the parameter order AFTER the call to IDispatch::Invoke when I am returning them to the calling app, however, I forgot to reverse them on the way in prior to the call to Invoke.

Holy "you-know-what" the errors are so esoteric to someone without a ton of experience with this stuff!

Once I fixed the order of parameters everything behaved exactly as expected. "Variation 1" from my question was, of course, the correct way to handle the BSTR* parameter. For clarity, here is the correct way to initialize a variant parameter for a BSTR* parameter being called by IDispatch::Invoke (in my case there are 2 other parameters that are not shown here)

VARIANTARG* v = new VARIANTARG[3];
//...Init my first 2 args IN REVERSE (not shown here)

//Init my third arg which is the BSTR* parameter
VariantInit(v[0]);
BSTR val = SysAllocString(L"");
v[0].vt = VT_BSTR | BT_BYREF;
v[0].pbstrVal = &val;