dbd::oracle is going to treat NULL's as undef coming OUT of queries, but not inversely. in other words, you need to pass the string 'NULL' in your bind params or execute instead of passing perl's undef.

This is wrong. From the DBI docs on placeholders:

Undefined values, or "undef", can be used to indicate null values.
[download]

But it goes on to say that for SELECT statements, this won't work in 'WHERE field = ?' clauses because nothing is equal to NULL, and suggests an alternative in the case where you're looking for a possibly NULL field.