diff --git a/apps/vectorcraft/src/gpu.rs b/apps/vectorcraft/src/gpu.rs
index d7d917ed4..0bf4732ed 100644
--- a/apps/vectorcraft/src/gpu.rs
+++ b/apps/vectorcraft/src/gpu.rs
@@ -310,7 +310,7 @@ fn pci_ids(device_id: &str) -> Option<(u32, u32)> {
     let field = |key: &str| {
         device_id.split(['\\', '&']).find_map(|part| {
             let (name, hex) = part.split_at_checked(key.len())?;
-            if name.eq_ignore_ascii_case(key) { u32::from_str_radix(hex, 16).ok() } else { None }
+            if name.eq_ignore_ascii_case(key) && hex.bytes().all(|b| b.is_ascii_hexdigit()) { u32::from_str_radix(hex, 16).ok() } else { None }
         })
     };
     Some((field("VEN_")?, field("DEV_")?))
diff --git a/apps/vectorcraft/src/gpu/tests.rs b/apps/vectorcraft/src/gpu/tests.rs
index 40e6a555c..f424280b3 100644
--- a/apps/vectorcraft/src/gpu/tests.rs
+++ b/apps/vectorcraft/src/gpu/tests.rs
@@ -820,3 +820,10 @@ fn crashes_are_forgotten_in_another_version_or_under_another_preference() {
     assert_eq!(record.crashed.len(), CRASHED_LIMIT);
     assert_eq!(record.crashed.last().map(|c| c.key.as_str()), Some("Dx12:10de:0013"));
 }
+
+/// `u32::from_str_radix` accepts a leading `+`; a device id with one is not a PCI id.
+#[test]
+fn pci_ids_reject_a_sign_in_the_hex_digits() {
+    assert_eq!(pci_ids("PCI\\VEN_+10DE&DEV_2204"), None);
+    assert_eq!(pci_ids("PCI\\VEN_10DE&DEV_+2204"), None);
+}