Mobility management is a prominent feature in cellular networks. In this paper, we examine the (in)stability of mobility management. We disclose that handoff may never converge in some real-world cases. We focus on persistent handoff oscillations, rather than those transient ones caused by dynamic networking environment and user mobility (e.g., moving back and force between two base stations). Our study reveals that persistent handoff loops indeed exist in operational cellular networks. They not only violate their design goals, but also incur excessive signaling overhead and data performance degradation. To detect and validate instability in mobility management, we devise MMDIAG, an in-device diagnosis tool for cellular network operations. The core of MMDIAG is to build a handoff decision automata based on 3GPP standards, and detect possible loops by checking the structural property of stability. We first leverage device-network signaling exchanges to retrieve mobility management pol...