Metastability simulation
Metastability is generally not oscillation, but the signal from a latch, not an inverter, hovering around 50% of rail for an extended period of time before settling to one or other state.

Just a few weeks ago, I successfully observed metastability in an LtSpice simulation. I googled for a transistor level model of a d-latch, and then used a binary search for the exact input voltage that would make it metastable.

If you look carefully at the latch, you'll see it is a pair of inverters 'hugging each other', with two transmission gates, one to break/enable their feedback loop, the other to connect an input signal in, driven by anti-phase clock signals.

You need those transmission gates, or at least something like it, to set the initial conditions required to get the inverters into the metastability region. As an alternative, you could simply use a pair of inverters, with a low value capacitor to one node, say 1fF, and set the cap's initial conditions parameter to force the initial voltage. However, doing it with transmission gates like this is more realistic, it's what is actually inside a d-latch.





These FET models I found are from a very fast process, hence the low voltage. The normal propagation delay was around 50pS, here you can see the delay has increased to around 600pS, with an extended flat portion before the flop decides which way to settle. I couldn't get it any longer, as I've run out of precision for setting the initial voltage, and LtSpice internally probably only uses double precision.

The models were downloaded from CMOSedu.com, though I can't find the latch model yet, the cmosedu_models.txt should be easier to find. I can post my .asc file if you like and if that's possible.