>Worse, the changes are committed eventhough there was an error! I suspect that there's an implicit COMMIT somewhere but have no idea where.

Try

SET XACT_ABORT ON

BOb