diff --git a/programs/include/gui/truetype.hpp b/programs/include/gui/truetype.hpp
index 90ac56c..853a432 100644
--- a/programs/include/gui/truetype.hpp
+++ b/programs/include/gui/truetype.hpp
@@ -124,7 +124,10 @@ struct TrueTypeFont {
         montauk::read(fd, data, 0, size);
         montauk::close(fd);
 
-        if (!stbtt_InitFont(&info, data, stbtt_GetFontOffsetForIndex(data, 0))) {
+        // stbtt_GetFontOffsetForIndex returns -1 for non-font data; passing
+        // that into stbtt_InitFont makes it dereference data + (uint32)-1.
+        int off = stbtt_GetFontOffsetForIndex(data, 0);
+        if (off < 0 || !stbtt_InitFont(&info, data, off)) {
             montauk::free(data);
             data = nullptr;
             return false;
diff --git a/programs/src/fontpreview/main.cpp b/programs/src/fontpreview/main.cpp
index 44b2bc1..54bc128 100644
--- a/programs/src/fontpreview/main.cpp
+++ b/programs/src/fontpreview/main.cpp
@@ -345,8 +345,13 @@ extern "C" void _start() {
                 g_preview_data = (uint8_t*)montauk::malloc(size);
                 if (g_preview_data) {
                     montauk::read(fd, g_preview_data, 0, size);
-                    if (stbtt_InitFont(&g_preview_info, g_preview_data,
-                                       stbtt_GetFontOffsetForIndex(g_preview_data, 0))) {
+                    // stbtt_GetFontOffsetForIndex returns -1 for anything that
+                    // isn't a valid font (e.g. a directory or arbitrary file).
+                    // Passing that -1 into stbtt_InitFont makes it read at
+                    // data + (uint32)-1, faulting. Guard against it.
+                    int off = stbtt_GetFontOffsetForIndex(g_preview_data, 0);
+                    if (off >= 0 &&
+                        stbtt_InitFont(&g_preview_info, g_preview_data, off)) {
                         g_load_ok = true;
                     }
                 }
diff --git a/programs/src/fontpreview/manifest.toml b/programs/src/fontpreview/manifest.toml
index d5112b8..527178e 100644
--- a/programs/src/fontpreview/manifest.toml
+++ b/programs/src/fontpreview/manifest.toml
@@ -6,3 +6,9 @@ icon = "font-viewer.svg"
 [menu]
 category = "Applications"
 visible = false
+
+[launch]
+# Font Preview only opens an explicit font file; it has no use for a
+# starting directory. Don't hand it home_dir when launched from the Apps
+# folder (it would try to parse the directory path as a font).
+pass_home_dir = false