Is your problem you don't know how to add TDs to a live QH, or something else?
Section 4.10 of the EHCI spec tells you all you need to know about adding TDs to a live QH. Basically you have a dummy TD at the end of the queue, with the active bit set to false. Adding a TD is a matter of filling in that TD, adding a new dummy and setting the active bit.
What's malloc/free got to do with this???