Metastability error propagation with flip flop
The first FF is not always metastable. Assuming that input edges are uniformly distributed with respect to its clock, the first FF has a certain probability of going metastable that is related to the clock period and its setup/hold time requirements. If it does go metastable, it resolves itself within some amount of time &mdash; the probability of remaining metastable after time t is an exponentially decaying function of t.

The second FF has a much lower probability of going metastable, because it would have to get clocked at just the right instant when then first FF (if it was metastable) happened to be resolving itself. Otherwise, its output will be either definitely high or definitely low. The signal change might be delayed by an extended metastability of the first FF, but it is very unlikely to cause the second FF to go metastable and adversely affect the operation of the rest of the logic.

A third FF reduces the chances of metastability to infinitesimal levels.