I would recommend using the Unified API rather than the bus CSV which is a legacy feed. I would also recommend using an api_key and app_id at all times, as we may change the anonymous quota restrictions without warning, at any time.
You can find the bus stop referred to by the short code like this:
curl -I "https://api.tfl.gov.uk/StopPoint/Sms/73241"
HTTP/1.1 302 Found
...
Cache-Control: public, must-revalidate, max-age=302400, s-maxage=604800
Location: /StopPoint/490010260SD
If we follow that HTTP 302 redirect we get the full StopPoint info for that bus stop https://api.tfl.gov.uk/StopPoint/490010260SD
But actually since you want the arrivals, you can just put /Arrivals
on the end of that URL
$ curl "https://api.tfl.gov.uk/StopPoint/490010260SD/Arrivals" | jq .
[
{
"id": "875851908",
"operationType": 1,
"vehicleId": "LTZ1052",
"naptanId": "490010260SD",
"stationName": "St James's Park Station",
"lineId": "11",
"lineName": "11",
"platformName": "SD",
"direction": "inbound",
"bearing": "248",
"destinationNaptanId": "",
"destinationName": "Fulham Broadway",
"timestamp": "2017-07-27T13:15:21Z",
"timeToStation": 293,
"currentLocation": "",
"towards": "Pimlico, Sloane Square or Marble Arch",
"expectedArrival": "2017-07-27T13:20:14Z",
"timeToLive": "2017-07-27T13:20:44Z",
"modeName": "bus"
},
// etc.
There’s more information on the Arrivals API here.